Ok, here is the stupid answer,
Create a job that queries the event logs and send an email if it sees a login failure. Keep a table with the last time it ran and filter the results by time.
However, I don't seem to be able to query the event logs either.