[Simon]

A lot of WP press blogs (and other scripts) get hacked because someone doesn't remove the automatically-created "admin" username account. All that's needed at that point is the password.

Good idea to create a new user with an unusual name and a new password and give admin privileges to that use. Then delete the old admin user. Now only use that new user account for managing the blog. Use another username, with limited privileges, to post on the blog so the new admin name is never revealed in public (for instance as the author of posts).