Should WordPress core limit login attempts itself? Every account system should have this in place.