Locking

Hello,
I am building my own authentication system over FormsAuthentication but without using the ASP.NET Membership / Roles providers.
However, I am replicating some of the functionality. One I don't understand very well is the locking:
A user is locked if it is approved and if PasswordAttemptCount is higher than a given value in a PasswordAttemptWindow of T minutes, correct?
But where is this done? On ValidateUser or in Login?
I mean, consider that I create a form for the user to recover the password by giving its username and email.
Should the user be locked if the condition happens? Or only when tries to login?
If yes then I suppose both Login and RecoverPassword should use the method ValidateUser and in this method the locking mechanism would inside this method.If not then probably the locking mechanism should be integrated in Login method.          The ...