If he launches a script every 11 minutes he will not bring LS down..
If he has access to a botnet and does a DDOS no application will be able to protect itself from that. If you are that big of an organization you should have professional firewalls / IT support to handle that.

There is no feasible way to prevent DDOS attacks at the application end.

"If he launches a script every 11 minutes he will not bring LS down.." --> Of course :)
However the DOS can be either functional or technical, the result is the same : the application is unusable.

It could be at least a good idea to be able to disable this security measure (or specify IP adress/mask to enable/disable it).

Can we differentiate between bruteforce attacks and DDoS.

A login protection for false logins and a way to disable sending new generated passwords would be a good thing. To create a new user without sending the password in plain email would be good too.

Not looking at IP will make for easier DOS attacks.
Say you try to brute force my username from several IPs, so I lock out the user..
Now you have effectively done a DOS attack since I am no longer able to login.

Closing this, for LS3 feel free to implement your own AuthenticationPlugin that adds whatever "protection" you feel is needed.