Lots of good stuff Rui, loved the video.
If i may add 1 small improvement: If max number of attempts is reached and an account has a cooling period:
Send an email to the accounts email to inform the user someone may have tried to take over his account.