after N tries, don't lock them out, use a captcha or something else. lock out policies enable anyone to launch a denial of service attack on your site for every

after N tries, don't lock them out, use a captcha or something else. lock out policies enable anyone to launch a denial of service attack on your site for every one of your users they know email addresses for.