I'd say this case is very well handled by Tycho.
A typical malicious hacker attack could be like this:
Someone snoops around the forums, or use other sources, then find the e-mail address to likely deepbit users, and then run dictionary and/or brute force attacks the password.
This could be prevented by implementing a feature that will make the site deny access for say 30mins if you enter the wrong password 3 times. Then if you do it again after those 30 mins are up, your account will be disabled for the time being, and you'll recieve an e-mail with instructions for how to activate it again. Another solution could be to use a capthca system to verify user is human and not a brute force cracking bot, but it all boils down to how strict security you should have vs. how userfriendly it is. If it is too cumbersome to use the site, this might prevent some users from actually using it. Yet an alternative way could be to insert a delay for payout and send a warning to account holder if payout bitcoin address has been changed from another ip than the one the user usually uses. This feature is something that should be possible to toggle, perhaps with a 24 hr delay.
Security is important, but so is also useability. Good password should include both numbers and letters, and also special chars like "_", "&" and so on. The longer and more complicated the password is, the harder it is to crack it. Avoid passwords that have dictionary words in them.
Also it is not recommended to share your password with anyone.
Regards, happy deepbit miner.