Lock out

During my testing several of my test users have been locked out. I have noticed two cases that are undesired:
1) user provided invalid password, user supplies correct password, user hits back on browser and user invalid password twice more; user is locked out
2) once user is locked out, I thought a certain amount of time had to lapse and they would no longer be locked out. However my user continued to be locked out over 24 hrs.
Something must be wrong with my implementation of the membership provider. Where do I look?
 
   /// <summary>
   /// Verifies that the specified user name and password exist in the data source
   /// </summary>
   /// <param name="username"></param>
   /// <param name="password"></param>
   /// <returns></returns>
   public override bool V ...