If someone has managed to access the admin area by making it look like they are someone else, isn’t it all over anyway?
This to me is more part of your exclusions as this is the main way anyone gains access through WordPress… So not really, if you have a backup, just drop the Database, upload your backup and change the passwords – then perhaps look into additional security. A good plan is to not name the admin as admin for example (doing this on one site prevented a lot of spam attempted logins for me with people attempting to guess the password)
How likely is it that someone unwanted infiltrates the WordPress admin area?
This depends on your set up really, what security plugins you have, or if you’ve manually set up any restricted access such as IP blocking for certain files. The more you put in the more they’ve got to deal with. Most of these are risk reduction techniques which help to prevent brute force, etc.
The only other thing I can think of is to keep your web server maintained, secure and up to date so that users cannot use vulnerability loopholes to gain access to your servers.
WordPress accept security reports so as a community the more that is brought to their attention, in theory, the more secure WordPress will become. To be honest, unless your website is popular, and getting regular spam, hits, etc, you’re probably not going to be worth a hackers time.