Suspicious Activity Detector

You are given an array of login attempt records. Each record is an object (or dictionary) with the following keys:

• timestamp: A string representing the time of the login attempt in ISO 8601 format (e.g., "2025-01-06T12:34:56Z").
• user_id: A string representing the unique identifier of a user.

Write a function that accepts the following parameters:

1. A list of login attempt records.
2. An integer threshold representing the number of login attempts.
3. An integer window representing a time window in minutes.

The function should analyze the login attempts and return a list of unique user_ids for which there exists any sliding window of the given window duration during which the number of login attempts exceeds the threshold.

Additional requirements:

• The input list of login attempts may not be sorted by timestamp.
• The output list should be sorted in ascending lexicographical order.
• Consider edge cases, such as multiple attempts with the same timestamp, and ensure your solution is optimized for efficiency.

Example scenario (for clarification only):

If the threshold is 3 and the window is 5 minutes, then a user who makes 4 login attempts within any 5 minute period should be included in the output.

Provide a complete, runnable solution in the programming language of your choice.