If a user has entered an incorrect password for over 3 times, have your site automatically send them a password reset email, this way you cut down steps for them and facilitate the process to regain access to their account. This will avoid your users to bounce on account of not remembering their passwords. This guide gives you the necessary details for this hack.