Preventing Malicious Lockouts from Username Enumeration

I’m using Limit Login Attempts Reloaded and running into an issue where attackers are able to discover valid usernames and repeatedly lock out legitimate users. This is becoming difficult to manage since we have to constantly monitor and manually unlock accounts. IP whitelisting isn’t practical for our clients since most don’t know or have static IPs, so what do you recommend as best practices or configuration changes to prevent abuse like this while keeping the plugin effective?