Perhaps a better approach to the lockout:
Lock the account for x minutes after 15 *unique* bad passwords. So if the user changes their password, and another program keeps trying with their old password, that only counts as 1 attempt. It still only gives them 15 guesses, but would cause fewer lockouts because of badly behaved programs like the spam bots mentioned above.
