Did you work out your problems?
We've had a very similar occurrence today. Where quite a few accounts including the admin account were locked out. Looking at the audit logs show that there were many many failed login attempts from the btpool lines. It seems to be internal though (coming from internal IPs and UA), and not someone guessing passwords at the login screen.
I thought it could be poeple changing a login password and forgetting to change their password in the zimbranotifier app that we use. But no, no one changed passwords. I then thought it could be some weird FFox behavious but this repetitive failed logins occurred to people using zwc on firefox and IE8. strange.....
Code:
--> 5 previous attempts
2010-08-24 12:09:21,465 INFO [btpool0-2404://mail.xxxxxx.com.au:7071/service/admin/soap/] [name=xxxxxx@xxxxxx.com.au;ip=192.168.20.2;] security - cmd=Auth; account=xxxxxx@xxxxxx.com.au; error=account lockout due to too many failed logins;
2010-08-24 12:09:21,541 WARN [btpool0-2404://mail.xxxxxx.com.au:7071/service/admin/soap/] [name=xxxxxx@xxxxxx.com.au;ip=192.168.20.2;] security - cmd=Auth; account=xxxxxx@xxxxxx.com.au; protocol=soap; error=authentication failed for accounts, invalid password;
--> many failed atempts after this point