After getting a warning about repeated failed login attempts from Vietnam as a site administrator I have made the settings a little more strict. I have set the site to lock accounts after 10 failed password attempts in an hour (same for password reset). The failed account will be locked out for 4 hours.
Frankly, I’ve not seen any legitimate users come even close to this.
Stephen
Buxton, Maine
1982 London Roadster - "Kit Kat"