Simple answer there.... just have the system automatically lock the account if you statistically miss the password, just at it statistacally allows you in if you play properly.

Or maybe it's only accessible from secure locations - you don't go this much trouble to secure day to day stuff.

It's not unbreakable, but the idea that you're letting someone in by statistical analysis of their conditioned response to a game, including their mistakes is clever - no reason you couldn't lock them out or use other security measures by failure to meet that response.