Confluence does not prevent someone from making a script that tries every possible password combination for a Confluence account. There should be an option to set a max attempts and then lock out the user from the system. This is obviously a security problem as Confluence within most companies uses LDAP to authenticate and if user's LDAP's are breached then many other applications are breached.