But then it's trivial to lock someone out of their account by trying to login as them a bunch of times. That's why they'd key it based on ip and username, not ip alone.