I use a plugin called User Locker which limits the number of login attempts before the user is locked out. But it lacks an e-mail notification feature (apparently). I guess I really don't want to know how much evil lurks out there. Fool's paradise, I know. :(