Manual:$wgPasswordAttemptThrottle

Details
Limit password attempts to X attempts per Y seconds per IP per account. X is the first value in the array and Y the second one.