Because the email/password combination is already known. From a previous breach where you used the same combination. So the attacker needs exactly 1 attempt to

Because the email/password combination is already known. From a previous breach where you used the same combination. So the attacker needs exactly 1 attempt to get into your account. And with the ease of using botnets now, they can get access to a very large number of IPs to distribute the attack, so you can't reliably throttle at IP level either.