How to avoid hacker to try login

I’ve a wordpress website, this is what I’ve seen recently.

1. My admin name is changed to abc
2. I install a plugin (Stop Spammers) and see log contains lots of wp-login.php activities with username abc and failed to login.
3. I block “/?author=” user query in the firewall, I can see lots of user query activities (/?author=) are blocked.
4. I change my admin user name abc to xyz.
5. I check Stop Spammers log and still see lots of wp-login.php activities with username xyz and failed to login.
6. I wonder how do they get my new username ? Any other way to get username besides /?author= ??