Brute force attacks despite cookie-based brute-force-login prevention

Hey folks,

I have the cookie-based brute-force-login prevention feature enabled in the AIOWPS plugin on all my websites and I love the idea of it but I have been wondering how it can still be possible for attackers getting to the login dialogue without knowing the passphrase I set that feature.

Does anyone know how that is possible (I know it because I am still getting emails about locked-out IP addresses due to too many failed login attempts)?

Many thanks in advance.

Kind regards,
Alexander