After constantly being under attack in phpBB, I created a new forum by hand, which successfully prevents spam bots from registering, and I get a report for every failed login attempt, telling me the info they tried, their IP address, whether they're blacklisted, etc. Of those that are from spam bots, the login info I see from these spammers are garbled username and password, like these:
[username] => BKujXjbL
[password] => 2454HIYQYH
[username] => Antiretewssar
[password] => 4xi82JfkbS
[username] => a
[password] => CKNSC58E3U
My question is, why would spam bots try username/password combo that no humans would create? I feel trying something like smith/123456 has a much better chance of a successful login on a given site. At first I thought these are some "secret code" that can bypass the login script, but I quickly realized that there's no such thing as a login bypassing code. Or are they doing something other than cracking password?
*Update (2/10/2014) *
I've been getting around 15 failed login attempts everyday from these bots. Some of these usernames are real usernames (eg. Danielbold), some contain brand names (eg. in my case, for an originally-Australia-based winter shoes), and the rest are likely non-human usernames (eg. bnCwVFmIWbweQJr). All passwords are still unintelligible, possibly hashed passwords truncated to 10 characters. It was interesting to see an attempt to use identical username/password combo (Astectton/kea85aXe8W) on 2 separate occasions, so these combos should be from a certain database and not randomly generated on the spot. It's interesting to see that these similar attempts come in from different places: US, Canada, Netherlands, China, etc., suggesting it's a very common bot code that many hackers(?) use.
It's also really interesting that no one else has encountered the same problem.