03-09-13, 07:33 PM
I'm not sure if you have implemented this or not, but if not, you could add something that times users out after xx minutes if they make xx number of failed logins. It still doesn't solve the problem, but its a deterrent.