Ok, that's pretty funny. Nicely done

Step 1: find phishing site
Step 2: find/write brute force script that doesn't stop on successful login but has longer random delay between attempts (so it isn't obvious it's a form of a DOS attack)
Step 3: poison phishing site data

Use proxies from areas that would normally use the service the phishing site is mimicking.

Bonus step: in case the phishers use the same proxies source, make enough invalid login attempts to the actual service to get the proxies IP blocked so they can't use them to test the large number of invalid logins to find if any are valid.

It can also happen if your password expired. Active Directory is infamous for just locking accounts if your user doesn't change their password when they get the popup that it expired

Must have lowercase, uppercase, numbers, symbols, minimum of 5 chars, max of 8. No dictionary words, no reusing characters (one char instance only), no numbers in order (123), no letters in order (abc nor qwe), nor in descending order (987, mnb). Caps lock is a unique character that must be used. Password expiration every 28 days. Cannot reuse old passwords, remembers last 10 passwords. Cannot add a number or letter at the end that causes an ascending or descending pattern. Password field cannot be pasted into.

It's actually impossible to detect someone doing this without storing passwords in plaintext, which is incredibly insecure.

That or you just being obligated to change your password.

I've once had a user who managed to add a second keyboard layout by accident and switch to it on login. I found out when I reset his password and it still didn't work on the laptop of the users even if I typed it in myself.

Nah; this shit has been a thing since forever.