Rename the variable that keeps track of login failures

While it's similar in the way it's handled to the one keeping track
of emails sent, it keeps track of something different so it should
have a different name to avoid confusion.
Add an extra check in the middle of the bad login attempts

This is just to double-check that we're not blocking too early.
Account lockout when there are way too many attempts for an email

This is a global limit which applies to a given email address
regardless of the user agent's IP address.
Remove unnecessary (and incomplete) comment