Adding a Password Hash (key derivation) function to existing password storage solution
Since your HMAC key is held in the same database as the passwords you shouldn't count on it to do anything... If the attackers get the passwords, they get the HMAC key. So HMAC doesn't prevent brute forcing, and a password hashing function would provide both points 1 and 2 above.

Depending on your timeline you may want to consider using whatever function ends up being chosen as the winner of the Password Hashing Competition (https://password-hashing.net/). That's not expected to happen until Q2 this year though, so switching to or adding scrypt, bcrypt, or PBKDF2 in the mean time is probably a good idea.