And a captcha... stops this? Even if it did, how about adding a captcha on the second try or just when entering the backup codes?