I would think you alarm when login failure rate spikes. Realize what is going on, list the probably affected accounts, and lock those accounts until they chang

I would think you alarm when login failure rate spikes. Realize what is going on, list the probably affected accounts, and lock those accounts until they change their passwords. Doesn't seem like an impossible to mitigate problem.