It makes it easy for someone to launch a denial-of-login attack, just set a script to log in with n random passwords, then the user won't be able to log in. With a rate limit, once the attack is over or blocked, the user can log in. With a ban after n, they would have to manually reset their password after each attack, which could be set to happen eg once an hour.<p>Not that I've ever knowingly heard of someone getting attacked in such a way.