wouldn't leaving the admin account there, with a long 'random' string for a password, but with no permisions granted be more effective - the would be hacker finds 'admin' to attack, and isn't going to get anywhere with it even if he strikes lucky with the password. (Coupled with the wordfence plugin to temporarily lock the ip out so it can't mount a denial of service attack) (or does wordpress not give distinct responses for invalid password and invalid username?)