Hi Daniel,
Hope you are doing good.
Such locking issues are usually very complicated cause the J2EE server may interact with many external/ABAP server etc(using JCo destinations, JCo RFC destinations, system connection, /nSM59 connections), and if the password is set wrongly in one place and calls are made, then after a particular number of tries, the user will get locked.
Please go through SAP Note 1493272 throughly and the attachment LocationGuide.zip that contains the "How to create a new trace location in NW 7.10 and above.doc" document which shows how you NEED to create the "com.sap.security.userlocking". This won't be existing on your system; you need to create it.
After this check all the possibilities mentioned in the note.
____________
Kind Regards,
Hemanth
SAP AGS