The problem that I've seen with lockouts is that they become a route for denial of service attacks. If lists of usernames/emails are available elsewhere for us

The problem that I've seen with lockouts is that they become a route for denial of service attacks. If lists of usernames/emails are available elsewhere for users of the site - a NastyPerson can reasonably quickly lock your entire user base out of the system (either deliberately, or by a poorly coded password attacking bot). If you have per-IP lockouts then you're still open to bot-nets and the problem doesn't get much better. What seems to work best is to slow logins down rather than lock them out completely. Still lets users in, but slows down bulk attacks enough so that the risk is low. And having nice metrics / reporting tools so that you can spot attacks as they're happening and make appropriate case-by-case responses.