In reply to Andy W.

Spambots don't need much effort to identify your site as wordpres, after all 1 in 4 site is wordpress. the bigger the market share of wordpress will become the less relevant the question of "how do they identify" will be. but nice research, although I am sure the spammers don't use google.

The best way to prevent brute force attacks from bringing down your site is to not use a security plugins (a little exaggerating here). Login limiter brought your friend's site down because it needs to write to the DB on every failed attempt while the cost of just handling the request the usual way is non zero but it is much smaller then a write to the DB.