Also, usernames need to be normalized. Django considers admin@example.com and ADMIN@EXAMPLE.COM to be the same username, but this middleware doesn't, so it won't throttle it.