one user told us(on Feb.26) following rules works well:
<LocationMatch /wp-login.php>
# only match posts
SecRule REQUEST_METHOD "(^POST$)" "chain,id:'1303701',rev:'1',phase:1,deny,status:403,msg:'Too many requests'"
#set ip pagecount and expiry of 30 s
SecAction...