While this question is aimed at SSH, be careful about a similar vector happening on more standard http username/email and password logins at any website. Most

While this question is aimed at SSH, be careful about a similar vector happening on more standard http username/email and password logins at any website. Most people use the same username or email address for all sites. It's pretty common to attempt to log in with the wrong password for that site, but one that is valid for other sites with the same credentials. While that password attempt shouldn't be logged, there's no guaranteeing it isn't - perhaps even via rouge admin and unbeknownst to the rest of the company. The biggest threat here is email addresses as usernames, and attempting to login with the password that's actually used for the email account. Very easy to automate any incorrect (or correct) passwords against the original email account.