I would assume that you'd simply do (increasing) timed lockout periods by user/ip combination. At some point you have to accept that administrators will need t

I would assume that you'd simply do (increasing) timed lockout periods by user/ip combination. At some point you have to accept that administrators will need to do some work, and if 200 IPs are trying to log into the same account 5 times every 15 minutes you should probably email the user and lock the account.