Time proceeds from top to bottom. The TCP Wrapper logs connection events only, so there is no corresponding record for the end of the telnet connection. For convenience, the record is shown at the two times that correspond with the beginning and the end of the login session. The order of the records is the order in which each process terminated. This question will come up again and again in this series.
Intruders routinely attempt to cover their tracks.
For example, it is common to find process accounting records from user activity that have no corresponding login accounting records. Fortunately, perfect forgeries are still rare. This is the kind of logging that you should expect to find for login sessions. Each record by itself does not prove that an event actually happened. Nor does the absence of a record prove that something didn't happen.