> I think that lies under the authorization domain.

I don't think so. A client sent wrong username or password, so the authentication part isn't done yet. By throwing an exception after registering the flood, we can make sure the correct message will reach the client.
But maybe I'm missing your point? :)