If you ever had to manage a site that had user accounts, you'd have realized that locking down access before the 5th attempt is a recipe for an insane amount of user frustration.