The user is still the weak link in this chain. Basicly you are looking for two passwords, if someone really wants to brute force both they will.
If you want to get creative try customizing the way your board hashes passwords. My forum generates a salt based on my own rules and gose about md5 hashing differntly then stock vBulletin. It is possible to convert an existing forum with existing users to this format aswell.