Find a host that has a mod called iprotect compiled into the Apache web server. It takes care of automatically logging all ip's and usernames on the fly, no need to run a script, or use SSI calls. If a certain threshold is reached (i.e 20 different computers try to use the same username) then that username/password pair is disabled for 24 hours, and an email is sent to the website admin. We have been using it for over a year now, and it has saved our customers thousands in bandwidth charges due to fraudulent surfers giving out passwords
Tim