One possibility could be if they are logging in through a web interface that makes multiple connections to the ABAP system. We see this in our SRM system, for instance, and also in Portal connections to our ECC system. What we found is that a small number of incorrect logon attempts via a web interface could lock an account quickly, because each attempt makes two or three "attempts" behind the scenes.
↧