Lockout is per account, not per device. Someone guessing your email from another phone also counts towards your limit and can lock you out for the lockout time. Keep the duration short (15 minutes or less) so this cannot hurt for long.
A correct password resets the count. Failed attempts are forgotten after a successful sign-in.
The count can reset during maintenance. Lockout counters are kept in memory, so a server update can clear them early.
Blocked IPs do nothing yet. Don't assume an address is kept out.
