Secure Login: Lock User Acct after 10 invalid attempts

Could someone help me figure out how to disable user accounts in ColdFusion? What I am trying to achieve is this:
When a user makes 5 successive invalid attempts, his/her account will be temporarily locked for 20 minutes, after which they can try logging in again.
If after the first 5 attempts, they make another 5 successive invalid attempts (bringing the total # of consecutive invalid attempts up to 10) I want to lock their account permanently. The only way to reactivate the account now is by contacting the admin (in this case, me).
What is the best way to achieve this? If someone can just provide an outline (or pseudo-code), that’d be really helpful. If someone has the code for it, even better because that makes things very easy to understand.