A computer-implemented for protecting user accounts may include: 1) identifying a credential that a computing device uses to log in to a user account of an online system, where the online system is configured to perform an adverse security action in response to a number of failed attempts to log in to the user account, 2) determining that an old version of the credential is no longer valid for logging in to the user account and that a new version of the credential is required to log in to the user account, and 3) taking a remedial action that prevents the adverse security action in response to determining that the old version of the credential is no longer valid. Various other methods, systems, and computer-readable media are also disclosed.