For the timer, you would need some kind of a long running process to manage the timers, so you probably will need to implement that in whatever process is hosting your workflow and have the timer handler load your workflow and fire an event, TimeoutExpired or something. You could also do something sneaky using the .NET web cache (which is availble in all apps, not just ASP.NET apps)
http://www.codeproject.com/KB/aspnet/ASPNETService.aspx
I think I would also impelment the rule based logic srrounding the pin validation in a context or business object that provides context and events to the state machine. This particular state machine library is intended only to manage events and transitions, and leaves actually managing the state (how many times a user has failed with their pin) to the underlying business or context objects. I have considered having expression based conditional rules that can prevent or allow state transitions, but I haven't found the time to build that in. In the mean time, you can place such logic around event firing code in your business logic.
