You have three attempts per username. I like to have two usernames for tech use, just in case. You can adjust how long the lockout is for in the system options form.
There is no number of incorrect login attempts on the 3300. Passwords and usernames ARE case sensitive on the 3300.
Passwords on the SX2000 are not case sensitive, at least not on most Versions, but I remember hearing that Mitel was considering changing that requirement on a future release. There was also to be additional password security changes, like password/username having to be changed every three months (or something like that).