Moral of the story: Use 2 factor authentication, login lockouts and resultant bans don't work. Maybe if it's a single individual person doing it, but if it's a botnet which it usually is, you'd need to trigger for every bot in the network, which could be tens of thousands