The real question should always be how you detect and handle these attacks. Allowing someone to attack your service for 12 years and eating up your resources in the meanwhile just sounds too passive a solution.
If the only attack situation you're worried about is a online guessing attack, then there's no need to even hash passwords.