When trying to establish an ssh connection to a machine the password can be failed up to 3 times. The log that appears for the 2nd and 3rd time is different from that of the first time.

pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1
PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1

The match field for rule 5503 is authentication failure; logname= so it would only match the first event, discarding the following two. It is necessary for this rule to match both cases.