Rate Limiting Alone Won't Stop a Patient Attacker

IP-based throttling and account-based lockout solve different problems and neither substitutes for the other. Built and tested in NestJS: the exact response shapes @nestjs/throttler returns, a TTL interaction that silently re-locks an account the moment it unlocks, and why an email needs to be normalized before it becomes a Redis key.