I have the same issue. Specific usernames blocked, some IP addresses blocked but still getting attempts to log in using blank username.
One time I got more than 1,500 attemps within several hours.
Very annoying not to be able to directly block these attackers.