ORA-28000 w/ schema owner acct

Hi folks - we have a situation where the schema owner oracle account (SAPSR3) is getting locked repeatedly

SQL> select username,account_status from dba_users where username like 'SAPSR3';

SAPSR3 LOCKED(TIMED)

I've unlocked the acct, and then changed the pwd w/ brconnect -f chpass.....yet it keeps getting locked time after time.

How can I trace back to which process (external/internal) that is trying to connect using the schema owner acct w/ the wrong pwd (so I can get it sync'd)?

In SM21 or the WP tracefile logs I am not seeing this level of info about what process is doing it.

Thanks