Yeah brute force lockout is a destructive attack. A better lock-out approach is to disable logins for a period of time (say 1 minute)... i.e. as someone said a

Yeah brute force lockout is a destructive attack. A better lock-out approach is to disable logins for a period of time (say 1 minute)... i.e. as someone said above, you don't want to destroy the old password in case the reset was requested by someone else.