Obviously you just rate-limit per client IP. A rate limit strategy should limit the rate of the attacker not the victim. Rate-limiting per email address is ju

Obviously you just rate-limit per client IP. A rate limit strategy should limit the rate of the attacker not the victim. Rate-limiting per email address is just a DoS vector, anyone can prevent a legitimate user from logging in.