I'm aware that 3 1/2 months ago the settings for this were moved from web.config over to mailConfig.xml, and this is definitely something nice to have, however it only took less than 12 hours before a client locked out their entire organization from webmail using the default settings.

1) Since you are basing this on IP and not on the account being logged into, a default setting of 5 attempts is absolutely not a good default.

2) Why isn't this configurable in the IDS interface yet???

3) Why is this based on IP and not on the account being logged into?

Again, I appreciate that this was added, but the implementation has shortcomings, and it causes more real world problems than it solves out of the box as is.