> it is always about making it annoying enough that people don't bother. > But odds are the person attacking your site is not singling out one account to hack

> it is always about making it annoying enough that people don't bother. > But odds are the person attacking your site is not singling out one account to hack, they are trying bulk attacks with many accounts. I feel like these two statements are at odds with each other. A regular user is going to get annoyed. An attacker using a script and multiple attempts is simply going to include the other way of verifying if an address is real in the script.