Suppose Alice isn't able to break into Bob's email account, but Alice can still do damage to Bob (a VIP) if she can stop him from being able to use his own email (or any other online) account to send and receive important emails.
So what she does is she writes a computer script that guesses a random password (since most email addresses have the same username) so that it locks her out. Could this also lock Bob out?
What if instead of one or two computers, she goes on the black market and uses thousands of bot computers around the nation to target Bob's account? Or she manages to hack Bob's wifi network so she even has the same IP address? What's there to stop Alice from making sure Bob never gets to use his own account ever again? (Besides two-factor authentication, which most people don't use.)