User reports their account is being locked out repeatedly. How do you investigate?