What's wrong is that you said that the purpose of on LOGON was to trigger when people could logon to network services. That is misinformation.
The fact it happens to work for you is coincidence, on many networks you will simply receive an error message if you try to do anything except NICK USER PASS before raw 001 is sent.
