I have a web app. Existing users can invite new users by sending a mail throw the web app. 

If the user fails 4 consecutive times I block the acount for 5 minutes.

Currently there is no important information in the application.

The problem with the current policy is:

1. If a malicious user B want to block the user A he could try to log with A username's 4 times every 5 minutes. Then A couldn't log to the app.
2. I could block if the 4 fails cames from the same IP (and only block for that IP). But the malicious user can change his IP. I don't know how, but potentially he can fill my resources (because I have to take the count for each IP)
3. I can put captcha, but I'm not sure how much helps.

Can you help me? What can I read or do?