In reply to Jim Walker.

I also deal with hacked sites, and I concur. Brute force password attacks tend to kill a server before someone actually gets in.

The common reasons I see for being hacked:

* Old versions of WP
* Out of date plugins/themes
* Inactive plugins/themes with security holes ("I'm not using it, why should I update?")
* Third party (non WP) code on the account
* Virus on the computer captured passwords (this one happened to me, hush)
* Rogue admin installed backdoor

The last two are fairly exceptional.

Somewhere WAY down at the end is "My WP Password was sniped." Not that I suggest one log in to your network on a non-secure network, but knowing my username is Ipstenu? Not a secret :)