I suggest we just randomly say your username or password is incorrect.

"Your username is incorrect" "Your password is incorrect" "You hit the wammy. Try logging in again."

That way, you never know what's going on at all.