I worked for a State government about 10 years ago. Some asshole managed to lock every single user's account by having a script attempt a login with an invalid password 10 times. Nobody could work for ~7 hours.