Is there a time period that a user can wait so that failed attempts no longer count towards the five failure maximum?
No, the five failed attempts are not constrained by a time period. Five consecutive failures over any time period results in a lockout. Any successful login resets this counter.
Vault Help Documentation: N/A