Hi,
I have seen almost exactly this before, it was a product called "Foundstone" - the Wintel team had deployed this straight out of the box and it caused mayhem on the Unix Estate.
I would think that this one of two things.
- You have a security breach and you're going to have a significant issue.
- Or from what I can see there is some kind of Scanner running and it needs to be configured or stopped before it starts locking accounts and causing other issues.
I would be tempted to speak to the other teams and find out what has changed. Also watch for it happening on a regular basis "Weekly, Monthly etc".
It could also be that someone has got something to evaluate and don't understand the implications.
As advised earlier in the thread, find the machine and beat the user up - you have an excuse!
Regards
Gull04