Strange. They could just blacklist the offending IP addresses.
Changing account #is a good idea too. GD login can be done with email too, so this must change as well.
No, you can just log into your account with your account number or customer id. So change those two and you should be fine.
Was it actually GoDaddy security that confirmed your account was being compromised (or attempts were made) or just your theory? I would think that GD security would be much more proactive in their approach (i.e. immediately transferring your account to a new ID and placing a watch on it, etc etc... ?
Well infact what happened was I found my account blocked asking me to contact GD support. I asked the support why it was blocked and they said too many failed login attempts. After a few days it was blocked again, and then again.