Using pam_abl to disallow logging into an account that is being hit sounds like a easy way to DoS a box.