If the attacker doesn't care which account they break into, they could try a different account each time and then account-based rate limiting doesn't help as much.
(Depending on how many accounts there are that they can try.)
Hopefully they aren't able to get a list of all your user accounts. The IDs should not be iterable (like a UUID, for example!), and the friendly name (like an email address) is private information that shouldn't be getting out.
(Depending on how many accounts there are that they can try.)