[Ntrails]

I would assume that you'd simply do (increasing) timed lockout periods by user/ip combination.

At some point you have to accept that administrators will need to do some work, and if 200 IPs are trying to log into the same account 5 times every 15 minutes you should probably email the user and lock the account.