Massive failed logins
 

Hi, the problem is that within days of having been hacked my forum, users receive this message ...

What is the risk?

They are trying each user account hoping some of them are using one of the most common passwords. If users have strong passwords, then there is little risk. You could remind your admins and mods to have strong passwords, and maybe remind all your users if you want.

I would strongly advise telling users to use a unique password for your site. There have been cases where someone uses the same password on multiple sites and one of those sites gets hacked. Then the hackers go to different sites and gain access to accounts on the other sites because a unique password was not used on each site.

Unfortunately, nhawk is true. That is exactly how I got my email account hacked and then had my site domains stolen.... :/