Interestingly three of my sites which I thought were hardened by Better WP Security, BulletProof Security and Limit Login Attempts have over the last 2 days had the primary admin account user names attempt to login - and they weren't by me. An IP lookup informs me the attempts came from a server farm in South Korea.

My user names have never been exposed before during this ongoing bruteforce attack with the usual "admin", "administrator" and others being the only user names that have attempted to login in the past. Seeing my current user names in the email alert sent a cold shudder down my back. Somewhere, in all the precautions I thought I had taken, the user names are being leaked.

I've rebuilt the security and .htaccess files, deleted those admin accounts and even turned off the database cache (W3 Total Cache) in case the leak was there. Any suggestions on further hardening is welcome because the only other possible scenarios are either; a form of malware/keylogger on my local system (which is unlikely as they would also have the passwords) or there is an interception somewhere along the line (also unlikely as again they would theoretically have the passwords also).

I will look into "Google Authenticator for WordPress" as mentioned by Gordon above though.