Yes - it should be redesigned to lockout for 15 minutes from any IP
I got 14 emails listing 14 different IPs within 5 minutes
or maybe it is locking out from all IPs for 15 minutes
and it's the message that should be changed when there are more attempts from different IPs during the lockout period:
Account already locked but another attempt has been made by xxx.xxx.xxx.xxx
|