Ive had a similiar experience and can't recommend this plugin enough. The other one I like is Lockdown WP Admin. It allows your to set your own path for where the login page lives and blocks wp-admin from being accessible to the outside world. They can't hack you if they don't know where to login!