I've noticed a brute force attempt on several different WordPress installs that know the right admin user name for those respective sites...
It seems very strange that the hacker would be able to find the username but not the password... Furthermore, I've checked these WordPress builds, and I do not see where they are leaking that information anywhere - albeit that is likely the answer...
While I am not worried about the attacker getting through thanks to a whitelist I've already implemented - I am concerned that whatever vector this hacker is using could be used to obtain more sensitive information.