I have a similar problem. I am upgraded to 4.0.8 also, and I have manually added IP addresses to the banned hosts list, because they have continually tried to log in as admin. Since doing that, my log files still show admin login attempts from those very same IP addresses, even though I manually banned them in iThemes Security. The ban users function does not seem to be working at all, even in the latest update.