The user that you are attempting to log in to the Remote Access web site with has been added to the local Administrators group on your server, or to the Remote Desktop users group. Users in the Administrators group are prohibited from logging in to the server using the Remote Access web site as a security precaution.
As for how this might have happened, you (or someone else with the password for the console) did it by logging in to the server desktop and adding the user by hand.
I'm not on the WHS team, I just post a lot. :)