Mark the users password as unusable if too many unsuccessful authentication attempts

[ksnabb]

The Users with and unusable password should have a different way to retrieve a new password. Also the users that try to sign in with a false password should be locked out from the service byt setting their passwords as unusable.