Each AUTH on the submission port runs at least one bcrypt before it can fail, and one per domain for a member with several. Failed AUTHs don't count toward go-smtp's error limit, so one connection can keep retrying for as long as it stays open.
A session now counts its failed AUTH attempts, and the third failure is answered with a 421 and the connection is closed. A client with the right key never gets near the limit, and the firewall already rate-limits new connections to the submission port per source.