We have a user that had their account credentials compromised and was having spam sent from her Outlook Web App. We changed the password and it stopped the spam, but her account keeps getting locked out on our domain controller.
I'm seeing that it's being locked out from the password being entered wrong too many times. I would assume that it's just the hacker using the old credentials, however the account only locks out on the days that she is working and it always happens about half an hour before she even gets here. We also changed her smartphone email password to the new one.
Is this just a coincidence or could something else be causing this? Should we also make her a new username or is just changing the password safe enough?