We have the same situation here from time to time. Most common cause is a user who has saved their password with a job that runs on the AS/400. In our case Qport from New Generation Software. Everytime the user launches the job from their disktop icon the job attempts to log onto the AS/400 using the saved password. It only takes a few clicks of the icon before all the log on attempts are exhausted and user profile is disabled.
If you simply create the message queue QSYS/QSYSMSG then any time a user profile is disabled, a message will show up in QSYSMSG message queue. Drill down in the message to see which job disabled the profile, then look at the job log of the job referenced in the error message and you should learn exactly why the error occured.