Account is locked for 15 minutes, makes it hard to guess (in 5 attempts) passwords.
If it happens again, I'll block the IP.
Same IP is shared by many users of the ISP, I don't want to ban innocent visitors.
That's why I don't ban the IP's of spammers (free Xbox etc...).