First thing I would do is make sure you don't allow multiple logins. That way at least no more than 1 person can be logged into an account at a time. That will minimize the damage if the password is cracked or given out.
We log the IP of the person logging in... if the IP changes frequently within a short period of time the account freezes and we get a notification. Even if you have a dynamic IP it normally won't change 6 times in an hour.
|