http://bentasker.i2p/posts/blog/security/347-a-guide-to-designing-account-security-mechanisms.html
Although, as noted above, it's less effective nowadays, you can also consider introducing a minimum login interval for the originating IP as part of the graduated back-off. So if they've made 7 unsuccessful attempts to login to a single account, not only do you prevent that account from logging in for 2 minutes, but you prevent the originating IP from logging into any account for 2 minutes.