Thanks Jamie for your hint.
It indeed seems that CTools builds the user-login-form andlets other
modules alter it.
However, when looking at the code in user.module, function
user_login_block, it seems this is all very declarative: all the widgets
are declared as just members of an array, without any specific order. So
I don't really know where the orderis calculated...
Thanks,