>per account Nobody stops an attacker to use a fixed password and cycle the username. If your site has lots of users this could work pretty well. Your site cou

>per account Nobody stops an attacker to use a fixed password and cycle the username. If your site has lots of users this could work pretty well. Your site could even "leak" (like forums) usernames making this approach more efficient.