3 ms·

Just show captcha randomly on login, with the frequency proportional to login failure rate for an account.