We had a situation like this at work. My username was very common and got locked on our ssh proxies like clockwork with just the routine background internet scanning. I couldn't get any traction with getting this fixed. We had hardware 2FA (physical tokens), so brute forcing was effectively moot.

Then, strangely, various senior folks found their accounts getting locked 1-2 times a day, including the founder. That autolock policy died in a week, and they started looking for 2FA failures instead, as they should have.

I had considered "accidentally" setting up a ssh loop to do this but never quite got around to it. I assume somebody else did. I doubt that an infusion of sanity happened by accident.