An alternative might be for the user to be able to request that the block is cleared, and for that process to send out an automated email; if the user clicks th

An alternative might be for the user to be able to request that the block is cleared, and for that process to send out an automated email; if the user clicks the link in the email, the block is cleared. It's no less secure than a password reset and would mean that legitimate account owners can't be locked out of their accounts by attackers.