The refusal is the same 401 invalid-login answer as a wrong password and is counted by the login throttle. The activation is checked after the password and before the deactivation restore, so a refused account stays deactivated. require_activation false keeps the previous behaviour.