Which fails against any attacker with a botnet, so, solve the lockout problem first, and deal with DoS (which you can't ever really solve) later.