a great addition to this would be a link on the error page. "Click here to have a new password generated and sent to your e-mail address."
if someone who got the password from the site clicks on it, everyone else will be blocked. and given that people like to click things, this might happen quickly.
