Automatic blocked mail users

[vnet2]

Hello

The Zimbra mail server (version 8.6) is connected to an active directory controller operating under Windows 2008 R2. The passwords on both servers are synchronized.

For several days there is a problem with several users. Their accounts are blocked every few seconds. In the event log on Windows Server you can see that the mail server is constantly trying to log in to the account but gives the wrong password which after three unsuccessful attempts blocks the user in the mail and in the domain.

Both servers have been restarted several times, but nothing has been done.
This situation occurs only in five people. The rest of users do not have this problem.
I will add that these users, even if they do not try to log in to the mail, are also blocked.

What could be the reason?
Could the server have been infected with malware?
Maybe a script asking about these users has been installed?

Please help.