Have you considered the idea of using client side certificates? I assume that you are running your admin area over and an SSL connection.

With client side certificates in place any user with one, would not even get the web page as the ssl connection would be dropped.

While this not a solution that can be implemented in PHP (I think correct me if I wrong), it is a very good idea to sites that require a high level of security, however a user name a password still needs to be implemented as well.

SittingDuck