Forgotten password
Use "Forgot your password?" on the login page. You will get a reset link by email. The link expires after 30 minutes and works once.
For your protection the confirmation message is the same whether or not an account exists at that address, so it never reveals who has an account here.
"Invalid email or password"
Deliberately generic. It does not tell you which of the two was wrong, because that would let someone check whether an address has an account.
Locked out after repeated attempts
Sign-in attempts are limited per account and per network. Wait fifteen minutes and try again, or reset your password — a successful reset clears the block on your account.