What URL is the login requests sent to? Would changing the wp-admin directory to something random help avoid the attacks? Or does wordpress have another point of entry for authentication?