The best thing to do is to do a find. In even viewer, click on the Security logs. Then, click view > find. Only check the failure and error boxes. Then, put in the username getting locked into the description box. If you run finds there, it will highlight each even one-by-one for you to read the source machine of the lockout.