You should also look at the Failed Login Attempts to see how may people are attempting to login after you are full. Be aware not all attempts are captured but it will give you an idea of the demand. We ended up reducing our time out to 20 minutes to keep our license usage managable.
As for showing more logins that licenses probably counted a person active after they were timed out but not cleared. This is an average over the number of days in your range. I use this information.