Note: I just added an extra rate limit (will be backported to stable)
https://github.com/discourse/discourse/commit/d53e01619fb3fd879fe85cd1679f1601e40aa009
30 login attempts per hour, 6 per minute.
4 Likes