Knowing the site, On the web gui there is no locking or restrictions on the amount of times (max tried so far is 25)...
If someone will want hack the system it wont be probably thru the GUI...
Google/Microsoft/Visa and Many banks in the US failed on this,
Its all about the will and the "targil".
Dont forget that the database hold credit cards (for whoever put them on the site) and some other personal details - And there are the bored kids which
will do it just for fun and cause a chaos.
I started there...
Ebzed (a.k.a Mephistopheles (at the 90s...) 8-))