Signing in, creating an account, requesting a sign-in link and authenticating with an API token are now limited. After several failed attempts the next one has to wait, and the wait grows if the failures continue. Signing in successfully clears the count straight away.
The limits are set well above normal use: someone working out which password they used is not affected. Requests for a sign-in link are capped per email address as well, so the form cannot be used to send repeated mail to someone else's address.