[warmwaffles]

But it doesn't matter if they keep hitting their service with a list of known emails and then sending bogus passwords, 5 times per email per host.

[im3w1l]

Sorry for late reply. It was 5 attempts per hour per ip. Not per email.