We only need flood control when checking username & pass credentials. Besides, I think that is we test & fail 5 different credentials –using 5 different providers– we ought to increment the flood counter by 5.