best method is to lock the program for a set time (say 2 minutes) from letting you click the button that shows the password form. This will prevent random brute force hacking and allow someone that really did mess up on accident to try again.

The reason it lets you try over and over is when you unload the form, you erase the variable you are storing the count in. Move the variable into a module, and you can load and unload the form all day long and it will still have the same count. Method above is better though.