A user failing to provide the correct TOTP code more than
ten consecutive times will have their account locked, forcing
an email reset or time based reset.