if you read the writeup clearly, its account based lockout scenario and this scene wouldn't occur in IP based lockout. Since the account was locked out ,it also resulted in invalidation of logged in session of victim which resulted in DOS