Manual:$wgPasswordAttemptThrottle

Details
Limit password attempts to count attempts per seconds per IP per address.

Memcached must be enabled for this setting to work properly.