You could double the response time for every successive attempt from the same IP. You'd still need an absolute limit on the account, in case of a distributed a

You could double the response time for every successive attempt from the same IP. You'd still need an absolute limit on the account, in case of a distributed attack.