These scripts almost always attack the account called 'admin', so simply changing the name of that account solves that problem. Personally, I just use a random word from the dictionary. I also try not to use my admin account to make posts, but if I do I set my user nickname to something else to help with the obfuscation, and then use the 'Edit Author Slug' plugin to further hide the login name. Lastly, the Limit Login plugin helps people trying to get lucky.