I just read a BBC article about the WordPress botnet attacking sites using the "admin" username, only to discover that I can't change that admin username:
We have multi-site enabled, and any user that has the name "admin" we can't change, including the network super-user (which I have to enable on each site to get to show in the My Sites list).
What is going on? Am I supposed to disable those users (edit: can't disable them!), create a new admin user with a different username, create a new super user, etc? What a complicated mess.