Webmail now has a plugin called “Lockout” installed.

It is configured so that five failed login attempts on the same username will ban that username for fifteen minutes and five failed login attempts on different usernames but the same IP address will ban that IP address for fifteen minutes.