In reply to Richard.

As part of the install process, Wordpress should require you to pick a new Admin username (which can't be "Admin") and a login page name (which can't be wp-login.php -- and the other backend pages would be renamed accordingly). Those are the two changes that make the most difference in the various security plugins, and it really should be standard practice enforced by WP itself upon initialization.