MyCourts Online will automatically notify your user and yourselves should a login by one of your users fail. More details are located here
In most cases, the attempt to login was most likely caused when someone with access to the computer where this user's login was saved accidentally clicked the login button on an older saved webpage or link. The chances of a hacker attempting to obtain the users data are extremely remote.
The cost of investigating the actual login source computer are considerable and time consuming. MyCourts Support will probably be able to ascertain the IP address of where the attempt was made however you or your user would then need to contact their ISP to ascertain who's ISP account was using that IP address at that specific time of day. If it wasn't your user then the ISP would probably require a Court Order before it would divulge such information to the people listed in the Court Order. That would most likely be your respective Police or Government body.
Unless the actual login was made within the last 24 hours or so, MyCourts Support would need to charge a fee to obtain the IP address details for you.