Hacking WordPress?

In creating a WordPress site, I’m careful about creating Users and passwords that should be hardened. Yet invariably, I’ll eventually see a brute force attacker begin using one of my User names, with a dictionary on the password. How is that possible that they have used a legitimate user name? Also, is the username case sensitive? Over the past month I have had nearly 2000 attempts to login using a correct user name, although the capitalization was not correct. I’m baffled as to how that could have happened. Any ideas?