The "last login" message string could appear in the splash screen that comes up while GNOME is being initialized... There just should not be any indication that the username is valid until after the password is correctly entered. One of the reasons I also intensely dislike "click to login" interfaces like XP and "Happy GNOME with Browser"