You could use a
Dictionary<TKey, TValue>[
^] where the key is the username and the value is the attempts that are left for this user.
Dictionary<String, int> usersAndAttempts = new Dictionary<String, int>();
if (!usersAndAttempts.ContainsKey(userName))
{
}
Of course this will give every user three logins until he restarts your application, after which his three attempts will be reset. To permanently block the user you'd have to write something to a database which indicates that the specified user is locked.
Hope it helps! :)