Strange behaviour with throttle hits

I am seeing some strange behaviour with my login throttling. The hit counting is not adding up and i cant figure out why. I want the user to have 3 attempts at logging in, after the second attempt i want to return a message to the user saying they have had 2 attempts. But at the moment, i enter the wrong creds twice, it shows the message, but then it allows another 2 attempts ... The code is set to 3 .... I just cant figure it out. any help would be great.

public function login(Request $request)
{
    $key = optional($request->user())->id ?: $request->ip();
    $maxAttempts = 3;

    if (RateLimiter::tooManyAttempts($key, $maxAttempts)) {
        return view('login')->with([
            'error' => 'Account locked.',
        ]);
    }

    $credentials = request(['email', 'password']);

    if (! Auth::attempt($credentials)) {
        RateLimiter::hit($key);

        $remaining = RateLimiter::retriesLeft($key, $maxAttempts);

        if ($remaining === 1) {
            return view('login')->with([
                'error' => 'You have had two failed login attempts.',
            ]);
        }

        return view('login')->with([
            'error' => 'Incorrect username/email or password',
        ]);
    } else {

        RateLimiter::clear($key);

        return redirect('/dashboard');
    }
}