I am debating the merits of a feature being requested for our web application.
The request is asking for an email to be issued to a user when an account is locked. Accounts are locked after 5 failed attempts. For each failed attempt the user is simply informed of an invalid username / password and we don't indicate the account is locked on the front end, to mitigate against username enumeration.
My points against this request are
I am suggesting the feature could possibly open the email system to attack by locking all users accounts and issuing emails on mass assuming someone knows all usernames.
Feature does not add value to the user, as our product provides a nice forgotten password ability.
Any thoughts, recommendations or industry standard. From my knowledge as long as a secure feature allowing user to initiate forgotten password should suffice.