Ah, good to see other people taking action on this.

I've been writing quick little scripts in python that spam their page with thousands of fake usernames and passwords. Is it effective? Well, they try VERY hard to block me when I do it, and the site frequently 404s shortly after I start, often to switch to a different URL, so it appears to be at least some inconvenience to them.