@Jeffro

I agree, "admin" username will be assumed in many such attackes. The point I was trying to make is that changing the administrator username doesn't mean that someone can't find it out, eg in author page URLs.