Of course, but that's why I said it's best implemented with a login/error has occurred message. With all these methods the average user won't know what's coming at them. Of course, banning by IP is one of the best methods, that goes without saying, but that doesn't mean the other methods aren't useful. I know there's been a lot of fuss over cookies, but I don't give mine a second thought. The last time they got deleted was when I had to reformat the drive. Whether that's wise or not is another story, but I think it demonstrates the level of apathy you can expect.

Thanks for the feedback :)

Jason