Working on adding "lockout on failure" to my web app. Lesson learned, but really should have done this BEFORE the Twitter admin compromise.