Defender lockouts notification

Defender showing 3678 lockouts in the past 24 hours, yet I am receiving emails that there have been no lockouts.

Also, the Lockout time should be 1800 sec, but in the log the same IP is banned only for a minute.
Lockout occurred: Too many failed login attempts May 19, 2017 10:43 am 211.72.118.101
then I see
Lockout occurred: Too many failed login attempts May 19, 2017 10:44 am 211.72.118.101

And 3 pages more all 1 minute apart

The lockout threshold is 2 failed logins within 500 seconds and the lockout time is 1800 seconds

Please advise