Thanks Jamie for your hint. It indeed seems that CTools builds the user-login-form andlets other modules alter it. However, when looking at the code in user.module, function user_login_block, it seems this is all very declarative: all the widgets are declared as just members of an array, without any specific order. So I don't really know where the orderis calculated...
Thanks, Shérab.