Check the activity table for the login request. This should/might give you the method (web) and ipaddress of the requests that are locking the account.

Also shut down ALL CRM services to see if that helps eliminate the root casue.  (Tomcat / Fast Find / Escalations / Indexer etc.)

Activity table shows data as follows

I have shut down all the CRM services (Tomcat / Fast Find / Escalations / Indexer etc.) as said, but still, somehow the column user_AccountLockedOut is updated and locking the user.

I stopped CRM Email Manager service,  The column value remains null. 

How can I start the service without causing a locked out issue? Any idea.

Activity table shows data as follows

I have shut down all the CRM services (Tomcat / Fast Find / Escalations / Indexer etc.) as said, but still, somehow the column user_AccountLockedOut is updated and locking the user.

I stopped CRM Email Manager service,  The column value remains null. 

How can I start the service without causing a locked out issue? Any idea.

External? Odd. Never noticed that recorded before but it exists on other systems. Do you have it exposed exteranlly ? But looks like an app or something is using an incorrect password.

When I stopped CRM Email Manager, the issue is solved.

I set the password in Administration → E-mail and Documents → Advanced Email Management Server Options -> Manager Password. Did a metadata refresh and an IIS reset.

And then started the service.

But still, the column user_AccountLockedOut is updated thus locking the user.

Are you using a default script ? if it's custom then you 'might' have a direct db connection in there. Otherwise try a different user for the email manager (not admin) so you can see whether it still occurs. if it does then look into the script.

On the plus side at least you know what is causing the issue now.

I tried with another user as an Email manager. But still, the 'Admin' user is locking out.