After 4-10 false tries your IP gets 4h cooldown. After 3 more you get 24h cooldown.
If more than 2 IP's per HWID get 24h cooldown your HWID gets banned.
Not much is impossible, you can rotate Hwid on an emulated machine and use socks.
However it is HIGHLY impractical because you are right.
You are using one ip address 4-10 times before the cooldown. so 1 ip per 4-10 guess's and you're going to be using massive dictionary's of attempts.
Inefficient and ancient. Not to mention I'm sure they flag accounts with 1.6 million failed login attempts.