Thanks for the reply @dawid.matuszczyk,
That does sound possible but I’m not sure its correct for this case. e.g I have one user who has logged in several times over several days but only one login count. I have seen multiple ‘Success Exchange’ and ‘Success Login’ events in their History subpage which is suggesting to me they have provided credentials on more than one occasion, but is that not correct?