This is not a silver bullet, but maybe you should consider using two-factor authentication. For example: when a user creates an account, you require that she provide you with a phone number where she can receive text messages as part of the registration process. Then, when she tries to log in, you give her a temporary authentication code that will be used in combination with her username and password.
This declares an additional level of security for the system, since an attacker must know his username and password and have physical access to his cell phone in order to compromise his account.
Hope this is helpful.