return false;
        }

        // Check per-account limit
        if (username != null) {
            AccountAttempts account = accountAttempts.computeIfAbsent(username, k -> new AccountAttempts());
            if (account.isLockedOut()) {
                if (account.getLockoutExpiry().isAfter(Instant.now())) {
                    totalAttemptsBlocked.incrementAndGet();