The table sys.user$ has a column lcount, described as /* count of failed login attempts */.Can you have a look there, if Oracle still uses it even today?
