Locking the account is the wrong way to go about it since it makes DoS on known accounts trivial.

Blocking the IP or an increasing time between tries is, afaik, the "right way".