yourdomain.com/?author=1 brings up the admin username in most cases. I have seen a major increase in this attempt at brute force attacks recently. It is still rather lame to say it isn't a problem because you can fix it with something else that needs to be added. When you have over 120,000 sites attempting to brute force into your site knowing 1/2 the key gives them an advantage that even if you block bad attempts they will still make it easier on them.

Fortunately, there are 3 things you can do with the above knowledge without additional plugins.

1. Change the username of the first account at the DB level to something else that uses non-standard characters.
2. Create another "admin" level account (that isn't called admin, again with non-standard characters)
3. Change the first username to have no real permissions.

Of course...
Yes, you should use complex passwords.
Yes, you should use a different password on each site and username.
Yes, you should change your passwords every so often.

However, the "security" of a standard WordPress install sucks and should still be improved.

BTW, I am for additional plugins, however, I still believe that basic WordPress "security" can be improved at the core.