per user if you want to defend against targeted attacks. per IP if you want to prevent untarged attacks. so, both. add an email-reset for the limit so users ca

per user if you want to defend against targeted attacks. per IP if you want to prevent untarged attacks. so, both. add an email-reset for the limit so users can't be locked out of their accounts by a DoS.