Comment by hotpotamus

You're thinking of brute force attempts over the network which are very slow and as you mention should be subject to tarpits and lockouts. This is if you can get your hands on the hashed passwords; I would think a GPU cluster can do something from millions to trillions of attempts per second depending on the algorithm.