@Ade - I don't think it's that overblown, especially after using the Limit Login Attempts plugin for a few months. In 99% of the cases in which an IP address is trying to log into the site, the username of admin is being used. Some of the IP addresses have tried multiple times with the username of admin only to get locked out thanks to the plugin.

When I installed WordPress, I made myself an administrator and deleted the admin account. The author account is good advice, but too much of an inconvenience to me for it to be worth while. I'm definitely using a strong password though.