When you isolated the validation of the user in IsValid(), you lost the behavior that a null username fell out of the Login() method returning false. The behavior that you have is that if user is null, you are turning around and calling FailedToLogin() on the null user. Wouldn’t that cause a NPE?

Also where are you checking to see if the account is locked to see if you should bother validating the username/password anyway?

Argument validation, generally I try to move this as deep as possible to avoid issues. loginValidator takes a user name & password. Should it ever validate a null (or empty) user name successfully? This would essentially get rid of IsValid().

This would change Login to:
public bool Login(string username, string password)
{
var user = userRepo.GetUserByUsername(username);
bool isValid = loginValidator.IsValid(user, password))

if ( !isValid) // or (false = isValid)
{
user.FailedToLogin();
}

return isValid;
}

generally I’m a stickler for 1-way-in, 1-way-out.