Manual:$wgPasswordAttemptThrottle

Details
Limit password attempts to count attempts per seconds per IP per address.

$wgMainCacheType must be set to something other than CACHE_NONE for this setting to work.

To disable, put the following in LocalSettings.php: $wgPasswordAttemptThrottle = false;