When you do not enforce pre-authentication, the attacker can directly send a dummy request for authentication. The KDC will return an encrypted TGT, and the attacker can brute force it offline. You will see nothing in your KDC logs except a single request for a TGT.
When you enforce timestamp pre-authentication, the attacker cannot directly ask the KDCs for the encrypted material to brute force offline. The attacker has to encrypt a timestamp with a password and offer it to the KDC. Yes, he can do this over and over, but you'll see a KDC log entry every time he fails preauth.
So, timestamp pre-authentication prevents an active attacker. It does not prevent a passive attacker from sniffing the client's encrypted timestamp message to the KDC. If the attacker can sniff that full packet, he can brute force it offline.
Mitigations to this problem include using long passwords and a good password rotation policy to make the offline brute-forcing infeasible, or using PKINIT (http://www.ietf.org/rfc/rfc4556.txt)