Comment by jqpabc123

How do you fix this? Quite easy really --- simply limit the number of unsuccessful attempts before locking the account --- either temporarily or indefinitely.

Most security focused web sites do this now.