In reply to Miroslav Glavić.

1) People have weak usernames/passwords. There shouldn’t be admin as username, the domain, the author’s name (wptavern, jeffchandler, sarahgooding and so forth)

Knowing usernames is not an attack vector. usernames are intended to be public (or at least to be safe to be available to the public). Poor passwords is the problem.