Spit balling a bit here, but could you do a search of the 'Login in Audit Trail' set criteria to status = 'Failed' and then have this search email each time a new record is added?