We setup a series of emails that get more and more punitive as time goes on. But after a certain number of retries (let's say 3-5), we just lock the user out an

We setup a series of emails that get more and more punitive as time goes on. But after a certain number of retries (let's say 3-5), we just lock the user out and move on...assuming that the user is doing this deliberately. Once they're locked out, if they ever try to login again they won't be able to do anything but pay us. This tactic isn't advisable for all services though. If I was running a high-ticket PAAS service or something I'd probably have Account Managers reach the person on the phone before taking any action at all.