Perusing the users table I've noticed that for 75% of my users the column user_login_attempts is either 99 or 100. Most are 99, presumably the  few at 100 is because of recent change.

Currently when maximum number of login attempts per username or IP is exceeded the user needs to solve a CAPTCHA. 

As an additional measure to mitigate brute forcing attempts add a cool down period when maximum number of login attempts is exceeded.