They that is account provider can easily use delays and lockout an account after too many tries. 10 would work nicely. After 10, lockout account for 15 Minutes or more , GPU attack is now dead in water Oh account holder is locked out too? Yeah call that an attack alert feature. The question is how often does this mass attack happen to any one account? .