Well, how about the attacker knows when the user logs in, then? That's not exactly sensitive information ... or at least it shouldn't be. There sure are plenty of ways of how that info could leak out.

But also, an attacker might just not care? Just try to get into a vast number of accounts at a rate that generally, statistically, doesn't trigger lockout, and it might just be irrelevant that that triggers some lockouts here and there.