[latitude]

False positives are needed to mitigate the risk of brute-forcing abuse.

[tobias3]

If you need that you can always rate limit it with the exception that you can add to passwords e.g. if you queried "abc" perviously "abcd" does not count to the rate limit, but "bcd" does.