gistfile1.cs

var grouped = input.GroupBy(x => x.Login);
var loginTimes = grouped.Select(x => {
	return x.Window(x, _ => Observable.Empty<Unit>().Delay(TimeSpan.FromMinutes(5), sched))
  		.SelectMany(y => y.Count())
	 	.Select(n => new { Login = x.Key, Times = n });
}).Merge();

loginTimes.Where(x => x.Times > 2)
	.Select(x => String.Format("Bad user {0}!", x.Login))
	.Timestamp(sched)
	.Dump();