Password retrieval has been a standard feature for any website for many years. It's easy to do for users who have an email in their profile, and it gives the rest a good reason to enter it. When I created my account I added my email because I assumed that the feature existed. Good thing I haven't forgotten my password.

someone doing a few failed logins before successfully logging in won't look all that different than someone doing a few failed logins and then giving up, which is what most humans would do (as opposed to scripts).

people naturally tend to have a small number of cross products of usernames and passwords...once it gets too large we start forgetting parts of it.

a couple times in the past year i've forgotten my password for hn. after the first time it happened i wrote it down so i wouldn't lose my precious karma.

How many accounts are inactive and with the last few logins failed?