I think rate limiting is a better option. If you only allow one log in attempt per X seconds, it becomes much harder to do a dictionary attack in a reasonable amount of time.

This to me is the way to do it. You can limit it to something pretty large like even or 3 tries, wait ten seconds or something. Basically making it normal speed for a human but waaay slow for a computer is the trick to me. A dictionary attack has to try tens of thousands of words and combinations to crack an account.

what? wouldn't that mean that anyone could try to log in to barackobama n times, get his login name changed, and then get barackobama's name?

You wouldn't get his followers, but you'd get a premium name easy.

That assumes that the login name is the same as the account name.