Exercise 3: One Account vs. Many Accounts, Same Source — Possible Solution
====================================================================

WHY THE TWO PATTERNS ARE TREATED DIFFERENTLY
------------------------------
Per this chapter's own warning box, "repeated failed logins for the
same account from the same source usually just means someone forgot
their password" - a routine, low-concern event. "Repeated failed
logins across many different accounts from the same source is a
genuinely different pattern... and worth escalating rather than
treating as routine, even though both can look similar at a glance in
a raw log." The chapter explicitly separates these two situations
despite their surface-level resemblance (both are "repeated failed
logins from one source").

WHAT EACH PATTERN MOST LIKELY INDICATES
------------------------------
Per this chapter:
- Same account, same source, repeated failures: a legitimate user
  struggling with their own password - routine, per this chapter's own
  characterization.
- Many different accounts, same source, repeated failures: "often
  credential stuffing or a brute-force attempt" - a real security
  concern, since one source systematically trying many different
  accounts is not something a legitimate single user forgetting their
  own password would ever produce.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly restates why these two patterns get different treatment
despite looking similar in a raw log, and correctly names what each
pattern most likely indicates - a forgotten password versus a
credential-stuffing/brute-force attempt - directly per this chapter's
own explanation.