Determining the threshold of your password policy is quite objective. Depending on how your authentication is setup, you can either have a low number of bad logon attempts (1-3) within a certain period of time and a higher administrative overhead or a higher number of bad logon attempts with lower administrative overhead.
Low bad logon attempts
Consider the example where a user only has 1-3 bad login attempts and they are locked out of the system. This minimizes the chance of a successful password attack and prevents almost any bruteforce attempt. This threshold provides the greatest security that you can achieve through bad logon attempts.
Only a few bad logon attempts will lock out the user and the account will be required to be unlocked before another logon attempt. This does make it easy to preform a DoS on yourself, your teacher, your boss, or your friend.
High bad logon attempts
A reasonable number of bad logon attempts over 5-10 is considered to be high. If a user needs 10 tries before they get the right password it is probably because of infrequent logons or they simply don't remember their password.
With higher bad logon attempts, there is a greater chance of success during a password attack. If the users type their password correct before the threshold, then there is no administrative overhead.
No Bad logon attempts
This is usually found when logging on a local system with no network authentication, like a home PC. In network authentication, this method is asking be subjected to a password attack.
Of course this will allow unlimited number of password attempts by anyone.
Companies and organisations have to pay people to help with unlocking customers/employees accounts. The most common way is by using a password reset system through email. It costs money to develop, support, integrate, and maintain a system like this. However, it is quite cost effective to the other alternatives.
A help desk will help solve any problem that the email system cannot. If a user forgot the password of your site, maybe they forgot the password to their email password too!
Large schools, banks, organisations can be targeted with a dictionary password attack. When there are more accounts, there is a better chance of a successful attack. And when you can attack an account many times before it is locked out, it has a greater chance of being compromised.
If the school UCLA has 40,000 students, you would expect some of the accounts may have passwords that include "UCLA", "bruins", "college", as well as weak passwords.
It is up to the managers, administrators, etc, to pick the password policy that fits their situation. Many things would be included in this decision and some are: cost of data loss, administrative overhead, cost of security, cost of potential down time.