An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users.