@amy @mhoye you can do a similar trick on the author pages of the site to match userids to usernames (link to author usually on each blog post, if that isnt disabled).

i kept noticing that attackers were trying real usernames but our display names were always deliberately different and I was confused as to where they were getting them from so again went on a bit of a dig about this and built a few poc tools to try and recreate their results (so that I could then block them to infinity)