How to reset/save $_SESSION variables in forms for each user?
By default Drupal's sessions are kept for about 23 days. You can modify this in settings.php. Look for gc_maxlifetime and cookie_lifetime to reduce it to 0 so sessions are destroyed when the browser is closed.

This will effect logged in users too so when they close the browser they will also be logged out.

On a side note if you were unaware drupal already have flood control and will block IPs for multiple failed login attempts