They're probably just typing in the wrong password. From the looks of things,
default.asp is your login page. If the login fails, the user is returned to
default.asp with an error code of 1. Problem is, your page doesn't do anything
with that error code, so the login page would appear to be the same to the
user. I noticed your access denied URL is also default.asp, but with an error
code of 3.
Of course, if your login page is NOT default.asp, then I just made a fool of
myself.
Nonetheless, I don't think you posted all your code. The submit button's
onClick even calls the JS function checkSubmit(), which doesn't appear anywhere
in your code. Maybe there's something wrong there. Just guessing.