@mike finley -

Mike, in many cases people will disable the "wordpress notifications" that specify an error with login attempts. This is done to prevent scripts from guessing usernames or passwords. Don't forget a script can be programmed to loop through combinations pretty easily and then grab the code to self check if it gets a hit.

Once it gets a "valid" username it will just keep looping passwords. Having a "non-privileged" admin does not truly gain you benefit over having none to find at all. Quite the opposite, in fact is that if they think "admin" is valid they may hit it with 10,000 hits trying passwords which can cause server load issues.

If they get a 404 or username does not exist then they may stop entirely until a different username found to work.

For string randomization I actually create a sentence, then pass it through a hash generator over at whatsmyip.org. the likely chance someone is gonna guess it is pretty slim. Then I store them using KeePass (free RoboForm)