Comment by altermetax

Locking you out after a few wrong tries only protects against online attacks. If someone gets access to the database, they have as many attempts as they want.