Password managers help reveal shenanigans like this. I've been able to reproduce the one-off errors caused such annoying behavior on a couple of sites.

Brute forcers will code to try twice