@annika
You don't have a Microsoft account, do you? ๐
Because that's exactly what they do. They also often lock me out for "suspicious activity", but I'm certain that it was me who forgot that I'm on TOR and still attempted to log in.
So I have to change my password six times before I can reset it back to the original one โ yes they have the same policy Active Directory has by default ๐ฉ