Every action is recorded against the person who took it. Repeated failed sign-ins from one address are locked out.