I don't get what prevents an attacker from deleting the secrets of everyone by just guessing? Shouldn't the guesses be time limited instead (e.g. once per hour)? Even then you could easily bring the service down...
If someone attempted that large an attack, it would be pretty visible, and perhaps there's a mechanism to reset those tries after an amount of time. Targeted attacks on the other hand...