I just cruzed SamarkandsWorld.com forum, and they can beat any password scheme you got going with the exception of locking it down so tight with site generated long user/pass with custom captcha's and other things that surfers will just get pissed off.
They have teams of people teaching eachother how to get lists of fresh proxies and they software like this to find legit user/passes:
https://youtube.com/watch?v=w4KuAR_obLs
Of course you can make it harder for the general password traders, but you can't keep em all out from what I've seen.