yes, he can know all the users registered on ur site..its pretty simple with brute force. eg.. the bruteforce program enters a username:admin and password: xyz if there are no registered user called “admin” the login screen would return “invalid username” and if there is a username called “admin” it will return “invalid password”…So he can make out which are the valid usernames.
prolly this plugin might annoy him and he’d give up bothering u =D
login lockdown
sorry for bad english.
good luck!