Good question. Memo, do you throttle attempts and/or lockout accounts for bad logins? Of course not sure how they would know usernames as they are not public.
We have some throttling, but this was coming from lots of different IPs and wasn't targeting any specific accounts.
