In your process, people will get a distinct error code depending on whether the account exists or not. This is often considered somewhat inopportune. It is preferable if it is not possible, for outsider, to know whether a given account name exists; therefore, observable behaviour of your server should be the same in all situations which depend on the account name and lead to a failure: account does not exist, account is disabled, password is wrong. Note that "observable behaviour" includes not only the error code you return, but also the time taken by your server to respond (if you use slow-and-salted password hashing à la bcrypt -- and you really shoud do that -- then password verification can take a non-negligible time which can be measured from the outside).
Banning an IP address after a few failures has the following caveats:
The IP address you see could be shared between several people, in case of NAT. This is very common in organizations. Also common are HTTP proxies. You don't want three failures from one user to induce your server into banning a complete university, or even all the customers of a specific ISP.
Sometimes, people forget their password. This happens a lot. So you will get "legitimate" login failures. Such users will want to use the "I forgot my password" process, and they will want to do it immediately. Therefore, the ban must not be long (say, ban for one minute at most).
Attackers who are intent on trying a lot of potential login+password pairs will have relatively little trouble finding relay hosts to work around your IP-based banning. E.g. Tor, by construction, decreases the efficiency of IP banning.
Therefore I do not recommend IP address banning on a general basis: it has a high risk of disrupting service for normal users, while not being very effective against average attackers. IP banning is useful against burst situations with crude attackers (e.g. automatic attacks from botnets trying to replicate), with tools like Fail2ban, but they can backfire, so caution must be exercised.
Note that blocking accounts can also backfire:
Blocking an account after too many failures means that anybody can block the accounts of other people.
Attackers who try many login+password pairs can spread their attempts over a lot of distinct logins, avoiding the blocking feature.
Reasonable solutions involve time-limited blocks (lock an account for one minute or so after a few wrong passwords) coupled with time-limited IP banning when a very suspicious access pattern is identified (a lot of connection attempts from the same IP). They will not give strong protection (only strong user passwords will), but they may help in reducing the noise from low-grade attackers and let you concentrate on the few cases where attackers exhibit an unusual amount of competence.
