You're talking about 10 minutes for a simple way to filter 18,000 attempts down to 5.

Security, like everything else out there, should be prioritized according to ROI. This is a pretty good ROI...maybe not better than picking good passwords, but definitely better than many practices that IT departments advocate.