Magento Ban or lock the user

- Create a custom customer attribute of boolean type say: is_banned_customer
- Then set the value of is_banned_customer = 1 if that customer retries more than a threshold times.
- Then during login in check for that custom attribute as:
Mage_Customer_AccountController::loginPostAction()

public function loginPostAction()
    {
        if ($this->_getSession()->isLoggedIn()) {
            $this->_redirect('*/*/');
            return;
        }
        $session = $this->_getSession();

        if ($this->getRequest()->isPost()) {
            $login = $this->getRequest()->getPost('login');
            if (!empty($login['username']) && !empty($login['password'])) {
                try {
                    $session->login($login['username'], $login['password']);

                    /* check if user is banned::start */
                    if($session->getCustomer()->getIsBannedCustomer()){
                        //logout and redirect to info page or any page you like
                        $session->logout();
                        $this->_redirect('*/*/');
                        return;
                    }
                    /* check if user is banned::end */

                    if ($session->getCustomer()->getIsJustConfirmed()) {
                        $this->_welcomeCustomer($session->getCustomer(), true);
                    }
                } catch (Mage_Core_Exception $e) {