[BMSmnqXAE4yfe1]

This scenario is not realistic, as you can just lengthen time between subsequent login attempts per username.

[mobjack]

Attackers only need one attempt per username.

They will use a leaked list of millions of username and passwords, then use a botnet to try them all on another website.