nonces are a kind of salt provided by the server. They have a reasonable length of time for normal use time in default settings so errors here are probably malicious, or a person resuming a session they left of hours ago.

As I put in the comments, the max retry cannot be set too low because an initial fail is pretty much expected for the client to begin authentication so even this login from a few hours ago scenario shouldn't cause a ban.