After Googling like crazy, I found this and many other reports of the problem from July 2018 --- but none with answers. So here's worked for me, recorded for posterity's sake.
The offending files seems to be wp-lc.php, found in /WP-LC, which is in the same directory as public_html. Disabling /WP-LC/ by renaming it only serves to break the website.
Within public_html/, there's a php.ini file that points to wp-lc.php using auto_prepend_file. Delete that line and the login page for wordpress will work. Ta da!!
(This doesn't solve the issue of recaptcha being out of date).