Daniel Cid

Oh, it is actually very common to scrape valid user names (and we are seeing it often).

Good example: http://www.acunetix.com/blog/web-security-zone/wordpress-username-enumeration-using-http-fuzzer/

We posted some details on this type of brute force here:
http://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html

But I agree with James, good web masters with good passwords do not have to worry about it. The issue is that many users have weak passwords and get easily compromised through it.

thanks,

This post has more details:

http://blog.sucuri.net/2014/07/malware-infection-breaking-wordpress-sites.html

thanks!

We added a default restriction of 5 emails per hour. New updates will have it disabled by default too.

Oh shoot, sorry about that. We wanted to turn it on for new installs, but we forgot about the upgrades.

We will get it fixed asap.

thanks,

You might have some malware that is dependent on W3TC to run. If you can send us your site, we can scan it for you to see if we can identify what is going on.

You can also try to scan it here: http://sitecheck.sucuri.net to see if it is a known injection.

thanks,

Nope, not at all. We do exactly like that (a file_exists) for the IP address, so it is a quick operation. Plus, we only do it for wp-admin access and not for normal visitors (GET requests).

thanks,

Try to look for executables or other downloads you might have in there (like .exe, .zip, etc). One of them is likely being flagged by McAfee.

thanks,