On: Twitter Hacker Says Admin Password Was 'Happiness'

[dmoney]

You could double the response time for every successive attempt from the same IP. You'd still need an absolute limit on the account, in case of a distributed attack.