Let me shoot a scare tactics your way since scare tactics seem to be what compels some people to take fix malware problem a little more seriously, or at the very least start thinking about the problem.
This is great news because it means that there's a strong community of developers and users who can improve the platform. However there's a group there will always be people who will attempt to take them down.
One step you can take is to delete the default administrator account. This is critical because if you don't do it, malicious user know a user name which they could try to crack.
As I (our untrue Joe the Hacker) know, people have way too many usernames and passwords to remember. You have got Twitter, Facebook, your online click here for more banking, LinkedIn, two blog logins, FTP, web hosting, etc. accounts that all include logins and passwords you will need to remember.
There is. People know they also Get More Information could just drop by with your login form and where they can login and try out a different combination of user accounts and passwords. So as to stop this from happening you need to install Login Lockdown. It's a plugin that lets users try and login with a password three times. Following that the IP address will be banned from the server for a certain timeframe.