An issue exists in Mattermost Server prior to 3.2.0. It mishandles brute-force attempts at password change.
mattermost mattermost server