Services that see lots of brute-forcing have ridiculously low success
ratios. To keep alerts for other services meaningful, we switch to a
different strategy for the spammy services: just count the number of
successful logins in the last 10 minutes and check that it is greater
than 0.

Simple, very-low-threshold alert on complete (>80%) login failures for
a service.