If a user tries to login and the email is required to be validated but has not been validated it will show a message that the account is locked.

Generally users should activate the account right away after they register using the link sent to them in the confirmation email, the admin user can re-send the confirmation from the manage user page.

I will add a wish list item in my project tracker to resend the email confirmation automatically if the account is locked because of the email not being validated yet.

If the email has not been validated then we cannot unlock the account after some time as that defeats the requirement for a validated email.

Once the email has been validated, if the user fails the password too many times within the configured time window, then the account is locked temporarily already and will be unlocked after the time duration configured. (this assumes you are using a recent version of mojoPortal).

So, it is already a temporary lock for failed password attempts after the email has been validated and it should be permanent until the email has been validated for new users.

Hope it helps,

Joe