User account lockout again and agian

I know that after an account's password has been changed, I'll notice this same problem. One thing I check for is to see if the account is logged into other machines via Remote Desktop. I will also check to see if the account's credentials are being used within a Scheduled Task. Each run of the Scheduled Task with invalid credentials will tally up one failed login attempt. Good Luck!

We have seen this after a password change when the email password on a smart phone didn't get changed. As the phone kept checking for emails the failed login count went up.

I use ALTools and find out what Server generated the lockout and then log on there, If its a Server 2008 box do a search in the sec logs for Event ID 4740
Once you find this, it will show you what machine locked out the password - like if you say it IS the ISA server then 7 outta 10 its defo a password has been changed/updated but not on their mobile device (I get this issue every now and again from our users), either that or they've tried to log in to owa from somewhere and put in the wrong password a couple of times!

This also might be a sign and infected system, trying to use the user's ID over and over, but failing hence locking out the account. I've seen this happen on user accounts and services accounts. Just for the sake of it, make she your antivirus is up to date, and scan the users PC and the servers they are attached to.