A critical flaw in the speed limit for failed MFA login attempts at Microsoft allowed unauthorized access to a user account.