You might also check and see what objects the profile owns - WRKOBJOWN
is the command for that.
1)We use AJS heavily, no IBMUSR on any of our LPARS.
However, if you set up multiple environment for AJS, (we have this on our R&D LPAR) then you must set up users and data libraries.
This is only done in Ops Nav.
This could be where the lock is coming from.
2) The other possibility is that someone create a service account called IBMUSER, and some automated processes may run under that user.
Do a WRKUSRJOB IBMUSR, see what results.