For now this is the best answer I can find, but I'm hoping for a better solution out there somewhere.

functions.php:

    function Remove_Unneeded_XMLRPC( $methods ) {
        unset( $methods['wp.getUsersBlogs'] );
        return $methods;
    }
    add_filter( 'xmlrpc_methods', 'Remove_Unneeded_XMLRPC' );

found this at: http://www.cryptobells.com/more-wordpress-xmlrpc-brute-force-attacks/

After having another attack this weekend, I am implementing this fix and will post any updates I find.