The game clients will lock an account out after ~20 or 30 attempts and I assume the website will do the same. No one is going to brute force an account.