I was getting an attack with hundreds of failed login errors in 2.3. I upgraded to 2.7 and am getting them still. I can't get the recaptcha to work. I enabled it and added keys but no it doesn't show.
I also limited the log ins to three failed attempts but that didn't help. The log in errors are coming from different IP addresses minute after minute.