Well I've never attempted, but perhaps there is a mechanism to lock an account after a certain number of failed logins for a given time period.