[IshKebab]

I assume payouts are linked to the severity of the attack rather than elegance.

Also in this case the throttling is an absolute requirement rather than a "nice to have, users set good passwords right?" thing.