See "Part VII" of this SO answer from Jeff Atwood describing mitigation techniques for "distributed brute force attacks"

http://stackoverflow.com/questions/549/the-definitive-guide-...

TL;DR - compute the average number of system-wide failed password attempts, and if it's over the norm, impose small delay on all users (except those that login via a persistent login cookie).