Admin accounts should not use the main website for access - they should only have access through an admin website. If you must let admin accounts use the main

Admin accounts should not use the main website for access - they should only have access through an admin website. If you must let admin accounts use the main website, then they should have a whitelist of IP addresses that they may log in from - and those IP addresses should map to the internal company IP addresses. Otherwise, if you absolutely positively MUST have admin accounts use the same website, and allow them access from outside the company, then you need to have a second factor authentication device like a SecurID token.