I would guess the max would be the maximum size of nvram. Each username/password is stored in the config file and the config file can only be as big as NVRAM. In most of my clients, after about 5 users they want RADIUS auth setup. Makes everything a lot easier.
HTH and please rate.