that is definitly going on all the time, however i can see the logs and proxy pass should be taking care of those. the attempts are no where near 100 tries a second
also something interesting is that the number of selects is really low compared to the number of change db queries, which is weird since there is only one db for this authentication scheme.