If someone attempts 500,000 failed 2FA attempts on an account, I think its safe to lock that account/take extra steps.