After looking through my acp, i found out that
1) in phpbbSecurity config you can set the amount of login attempts, after to much tries you get bannend. default = 3
2) in General Configuration you also can set the amount of login attempts, after to much attempt you get block for a will. default = 5
I don't know if this is a problem, and if one override the other?
I prefer the one in General config, where the user isn't banned, but blocked for awhile.