I've installed Limit Login Attempts with the strictest of rules. Probably 500+ banned IPs and no end in sight. It's like holding water in your hand while the tap continues to run.
Blocked ip ranges but that's a true test of patience. Unless there are extreme situations, it's rather futile.
The conclusion may simply be that there is no way of dealing with it. I'm sticking with WP but in a lot of ways it brings on every bot and every low life. Sort of like when you think of flies taking to ----.
Nutter I think you have pretty much summed it up. Ditch the stat programs and accept that as a downside of using WP.