My question about the 'Blocked by Wordfence Security Network' blocking was actually just asking to confirm that that type of blocking is distinct from the login security blocking that Wordfence applies when it detects rapid login/forgotpassword attempts.
As for the original problem: although I mentioned the lack of alert emails, that is not the issue. Watching the access log shows attacks happening, but looking at the Wordfence 'Blocked IPs/IPs that are locked out from login' tab shows that Wordfence isn't blocking them. The related settings are all set to the defaults.