trace jobs locking user via rfc

Hello experts,

in our productive system we have a user especially for the sap oss support access. This user is getting locked every 2-3 minutes. The transaction sm20 shows these entries :

09.02.2012 15:02:53 OSS-PB1 localhost SAPMSSY1 RFC/CPIC Login gescheitert, Grund=53, Typ=R 001 mlppb1

09.02.2012 15:03:18 OSS-PB1 localhost SAPMSSY1 RFC/CPIC Login gescheitert, Grund=53, Typ=R 001 mlppb1

09.02.2012 15:03:53 OSS-PB1 localhost SAPMSSY1 RFC/CPIC Login gescheitert, Grund=53, Typ=R 001 mlppb1

09.02.2012 15:04:18 OSS-PB1 localhost SAPMSSY1 RFC/CPIC Login gescheitert, Grund=53, Typ=R 001 mlppb1

09.02.2012 15:04:53 OSS-PB1 localhost SAPMSSY1 RFC/CPIC Login gescheitert, Grund=53, Typ=R 001 mlppb1

09.02.2012 15:05:18 OSS-PB1 localhost SAPMSSY1 RFC/CPIC Login gescheitert, Grund=53, Typ=R 001 mlppb1

09.02.2012 15:05:53 OSS-PB1 localhost SAPMSSY1 RFC/CPIC Login gescheitert, Grund=53, Typ=R 001 mlppb1

09.02.2012 15:06:18 OSS-PB1 localhost SAPMSSY1 RFC/CPIC Login gescheitert, Grund=53, Typ=R 001 mlppb1

As far as i can see the terminal column says "localhost" --> this means the rfc connection is comming from the same "physical" machine. We've checked the ABAP stack, there is no job running using this user. Furthermore there is no rfc connection on the system itself using this user.

Is there a possibility to get more informations about the incoming rfc connection ? E.g., increasing the trace level.

It might be some rfc connection coming from the j2ee stack on this machine. Is there some way to check in the j2ee server if there were some regularly jobs ?

Our system is a SAP Netweaver BW 7.3 on SP 4.

Kind regards.

Dirk