I personally know someone with a two letter twitter handle that is a word in the english language, for awhile there they were inundated with password request attempts, but it took knowing someone 1-1 inside of twitter security in order to put additional locks on their account, beyond what any config will show unfortunately.