so, I tend to disagree: your solutions were the old approach, where you keep trying to block, and hope they dont have a wealth of new source IP's to spawn their attacks from. I think what we find is, this doesn't work any longer.

The new approach I would advise is along your very first point: don't let the attackers know you are on to them: silently sink their traffic into a dead service that doesnt even attempt a password login, but don't let them know. You continue to handle their password bruteforces, but you DONT ever return a success. This could be a straight up static page. This kind of approach only works if you are happy to pay the bandwidth price.. but the nice part is: you keep the attacker occupied, they have no idea they aren't making progress, and the users accounts are safe.