Disabled User ID without a corresponding invalid sign-in

[Jim Hawkins <jhawkins@xxxxxxxxxxxx>]

We had an incident last week where a user's profile was disable, which would seem to indicate that the user tried to sign-on with the wrong password to many time. Contacted the user, they had not been signing into the system around the time of the profile being disabled. (I do see an attempt in the log at that time, but have not been able to trace where it came from).
On Monday, I run the following command (via job scheduler): DSPLOG PERIOD((*AVAIL *BEGIN)) OUTPUT(*PRINT) MSGID(CPI0C04 CPF0903 CPF0934 CPF0997 CPF0998 CPI091D CPF2234 CPF1120)
The report only shows one invalid sign-on for this user, and it was the following morning (corresponding with "I forgot I changed my password yesterday").  The only invalid sign-on I see for the day of the disabling, was 6 and half hours earlier for a different user.
Is there another message id I need to look for or another way to figure what happened to cause the user ID to become disabled? The only message ID see to indicate that the user profile was disabled is the standard CPF1393.


Regards,

Jim Hawkins
Programmer Analyst
Interkal LLC
Kalamazoo, MI