[ServiceBehavior(ConcurrencyMode = ConcurrencyMode.Multiple)]

[ServiceContract(SessionMode = SessionMode.Required)] //Required будет давать вам "отлуп" в виде экзепшена, если будете использовать несоотв. биндинг (например, basicHttpBinding)
public interface IMyContract
{
}

[ServiceBehavior(InstanceContextMode=InstanceContextMode.PerSession, /*опционально, если вам нужно*/ ConcurrencyMode=ConcurrencyMode.Multiple)]
public class MyContract:IMyContract
{
}

[ServiceBehavior(InstanceContextMode=InstanceContextMode.Single, ConcurrencyMode=ConcurrencyMode.Multiple)]

P>Да, и код валидатора в студию. Авось, вы там локами балуетесь

Thread.Sleep(1000);

 ServicePointManager.DefaultConnectionLimit = int.MaxValue;

sealed class MyPasswordValidator : UserNamePasswordValidator
{
        public override void Validate(string userName, string password)
        {
            Thread.Sleep(1000);
        }
    }

[ServiceBehavior(InstanceContextMode = InstanceContextMode.PerCall, ConcurrencyMode = ConcurrencyMode.Multiple)]
    public sealed class MyService : IMyService
    {
        public int Get(int i)
        {
            return i;
        }
    }
}

<basicHttpBinding>
            <binding name="SubscriberBasicTransportWithMessageCredential">
              <security mode="TransportWithMessageCredential">
                <message clientCredentialType="UserName" />
              </security>
            </binding>

<serviceThrottling maxConcurrentCalls="350" maxConcurrentSessions="350" maxConcurrentInstances="350" />

А><basicHttpBinding>
А>            <binding name="SubscriberBasicTransportWithMessageCredential">
А>              <security mode="TransportWithMessageCredential">
А>                <message clientCredentialType="UserName" />
А>              </security>
А>            </binding>
А>

А><serviceThrottling maxConcurrentCalls="350" maxConcurrentSessions="350" maxConcurrentInstances="350" />
А>

[ServiceBehavior(InstanceContextMode = InstanceContextMode.PerCall, ConcurrencyMode = ConcurrencyMode.Multiple)]

                        <customBinding>
                <binding name="InsecureBinding">
                    <textMessageEncoding>
                        <readerQuotas maxStringContentLength="2147483647" maxArrayLength="1000"/>
                    </textMessageEncoding>
                    <security allowInsecureTransport="true" authenticationMode="UserNameOverTransport"/>
                    <httpTransport maxReceivedMessageSize="1000000"/>
                </binding>
            </customBinding>

                     <service behaviorConfiguration="MyBehavior" name="Services.DataService">
                <endpoint address="" binding="customBinding" bindingConfiguration="InsecureBinding" contract="Services.IDataService"/>
            </service>

<behavior name="MyBehavior">
                    <serviceMetadata httpGetEnabled="true" httpsGetEnabled="false"/>
                    <serviceDebug includeExceptionDetailInFaults="true"/>
                    <serviceCredentials>
                        <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="SomeNamespace.CustomServiceUserValidator, Mycompany.AssemblyName"/>
                    </serviceCredentials>
                </behavior>