We should at least optionally notify a user when there is a failed login attempt. I'd have it enabled by default in core but we could also have it as a plugin on the marketplace or by default disabled.

We'd send an email to the owner of the account letting the user know someone tried to log in using his login name. Maybe we'd also add IP address etc? I'm sure there are many examples for this on the internet.

We could also only send it after the second or third failed attempt.

It is a bit related to brute force attack but not really: #2888