"What threshold should I set?" gets answered with a number far too often. Any number given without knowing the flow is someone guessing on your behalf.
The score is identical everywhere in your product. What changes is what a mistake costs.
Wrongly blocking a newsletter signup costs you an email address. Wrongly blocking a password reset costs you a customer who already pays you, cannot get into their account, and now needs support. Same score, completely different arithmetic — and any single cutoff is wrong for one of them by construction.
Two things I would argue for:
Work out the exchange rate before the number. How many real customers will you turn away to stop one bad signup? You do not need precision, but you need to know which way it leans, and that falls out of the two costs rather than out of a vendor's docs.
