For bruteforce protection/deterrance we use MemLogin
(available from
PaysitePowertools.com )
and use Iprotect (an apache module) for password abuse - though iprotect doesn't help much against proxy based attacks.
Memlogin basically hides the real members URL from everyone except you & your members. If you set things up properly you won't ever be bothered by bruteforce traffic spikes again =]