Does the log show what IP is in the rhost/lhost? If it isn't the localhost then perhaps you have a client trying to authenticate but failing just as the error shows? If it is the localhost then something indeed is wrong with the dovecot config.
I only see those errors when someone fails a login. I rarely see a persistent crack attempt but that too is always possible.
You might also do a cold restart of dovecot to make it isn't a hung session.