The most common cause of account lockout is when a user changes their password and doesn't immediately update their password on a mobile device with an email account configured for ActiveSync. I've even had one person tell me that they did update their password on their iPhone, then after repeated account lockouts they remembered the iPad they left at home that also had their company email account on it.
If mobile devices with ActiveSync accounts isn't the cause, I recommend using Account Lockout Examiner, a freeware tool from Netwrix.
Netwrix Account Lockout Examiner: Alert your help desk staff about lockout events and troubleshoot account lockouts, analyzing potential causes. Accounts can be unlocked within the console, a Web-based interface or via a mobile device.
Download it here.