The vulnerability stems from improper tracking of authentication attempts for invalid usernames. The USER command handler (ftp_USER) is responsible for validating usernames. In vulnerable versions, failed username checks didn't increment the 'attempted_logins' counter, weakening brute-force protections. This matches the CWE-287 description and the advisory's focus on USER command handling. The function name is inferred from standard FTP command handling patterns in pyftpdlib and the vulnerability's context.