Ah! You're right, I switched the two cases in the if statement around. Sorry for that, I just edited the original post. It should now work as intended, which is in plain language this: You eval a field "200_event" to contain a 1 each time a successfull login takes place, and then you keep a running total (the "id" field) of these events. This is useful because each time you have one of those 200 events, you can conclude that the last 401 has successfully been answered. This in turn means that a running count of the same attempt without a successful 200 answer (i.e. no change in the "id" field) can help you track down someone with multiple unsuccessful attempts.
If that didn't clear things up enough, feel free to ask further 🙂