Moodle's security model is not that robust out of the box. I think the best you can do is have an email sent to the administrator after a user has three failed attempts trying to log in. This is set here:
http://www.yoursite.com/admin/settings.php?section=notifications