In reply to Matt Mullenweg.

@Ian:

.. give the attackers a mechanism – an xml-rpc call with no legitimate use – that enables them to try hundreds of combos at once;

That actually has not worked for several versions now. If you examine the code for the XML-RPC endpoint, it will stop checking passwords after the first failure. It doesn't continue to retry "hundreds" of times, it simply fails the rest.

I'm not sure exactly when that change happened, but it seems like a bit over a couple years ago now.