@dwmkerr locked out after three attempts? Have you thought about:
1. Users deliberately logging each other out.
2. How long they're locked out for.
3. How we reset them in the backoffice.
There's a *lot* of work to support this - add a full new spec for the lockout behaviour to the pull request and we can **consider** it - but this is not a trivial piece of work