Getting insane amount of login attempt spam from possibly HASS App?

Configuration
, ,
2

Sounds extremely similar to this thread.

TLDR: check if you have other iOS devices (like a tablet) connecting to HA. Check the user settings (local only vs external access) and check the refresh tokens stored on HA.