If we are talking about Super Users, Administrators and Managers disable “Prevent forgotten backend users from logging in” or set “Login prevention method” to ‘Force password reset‘. You can have certain user accounts which never get blocked, defined in the “Protected users” option.
If we are talking about regular users, there are two settings which might be doing that.
One is “Treat failed logins as a reason for blocking the request”. This feature makes each failed login count as a blocked request. Too many blocked requests would block a user's IP (but NOT disable the user account itself).
The others are the options under “Deactivate users on failed login”. This feature will, indeed, disable user accounts after a number of failed requests and send the users an email to reactivate their accounts. I guess your users don't see that email or it ends up to spam. Set the “Number of failed logins” to 0 to disable this feature.
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!