Is there any way to limit the maximum number of attempts to reset or unlock a password? Overall and within a given time period?  We'd like to limit the number of failed attempts so that the users have to contact a help-desk/IT employee after the limit is reached.