This is some intended delay to prevent brute force attacks. A longer delay also prevents the attacker being able to guess the difference between username is wrong and password is wrong (hashing and checking the password takes noticeable longer time than checking the username).

Why would an incorrect password attempt take a lot longer to process than a correct one?
I'm interested in the simple algorithm for particles filter given here. It seems very simple but I have no idea on how to do it practically. Any idea on how to implement it (just to better understand how it works) ?

Edit:
This is a great simple example  that explain how it works. I've tried to implement it in C++: see my code here, but I'm note sure if I do it the right way. Can you please check if I understood it well, or there are some misunderstanding according to my code ?
