[nx]

Yes, that's the best way to prevent account hijacking, in my opinion. Or block the IP for 30 minutes after 5 failed logins, that renders any dictionary attack terribly inefficient.

[eru]

Better to switch to a captcha. Banning might provoke DoS attacks.