just flagging that I tried to login on my mobile (so probably not a stored ip) and of course messed up the login. It appeared to lock me out after 2 tries.
I was trying to support a new user who had also been locked out quite quickly.
I will try to recreate this later, just flagging for now in case anyone else seeing something similar.
thanks for very useful plugin particularly given the attacks happening lately.