Try the login-lockdown plugin to slow 'em down, regular back-ups with the duplicator plugin or similar to restore if they do get in and don't use...
Separate names with a comma.