Sounds like a password lockout policy is being tripped by a user entering the wrong password and either trying to connect repeatedly or using something like internet explorer as the FTP client (which ...