Account takeover and credential stuffing: shop defence
Stolen credentials from other providers’ leaks run against your login form, spread across many addresses and at ordinary speed. What counting per account achieves, where the block list check applies, what a second factor devalues and which response path holds after a takeover.