The password system also has no login attempt counter... so basically you could bruteforce all you want according to my brother whos a student there.