Many IT security standards actually require account lock-outs. For example, PCI-DSS requires it. No one seems to understand that the goal of the attack may be t

Many IT security standards actually require account lock-outs. For example, PCI-DSS requires it. No one seems to understand that the goal of the attack may be to deny access. The attackers may not want to compromise the account, only to keep someone (or a group of people) locked out for a bit while they do something bad elsewhere. Edit: I'm surprised an account would be locked by a DMCA request though. Block or remove the content (if it's a legit DMCA notice) but keep the account alive. That's just one more way to carry out this sort of denial of service attack.