Finding why a user profile gets disabled

["Valerio Vincenti" <vvincenti@xxxxxxxxxxxxxxxxxx>]

I have a user profile that's used once a month by an external agency to push a few files on my iSeries box via FTP (its password is set to never expire).
This has worked fine for a few years, but, starting a couple of months ago, this user profile is found in *disabled status when the agency tries to log in.
When that happens I re-enable the profile, but, the next month the user is back to *disabled status.
Wrong logins from the agency are to be excluded as they have the credentials coded in the program that pushes the files. 
 
I have scanned the system log (dsplog command *print) from last time the user was enabled (Friday 9/19 at 08am) and the first time I found it disabled (this morning at 8am), but couldn't find any reference to this user profile. I was hoping to find in the log some reference like "User profile XXXX disabled...", but there's nothing. I couldn't even find a log entry to show that this morning I have changed the profile back to *enabled.
 
I need to find what causes the profile to get disabled. Any ideas why the system log doesn't show changes to the user status? Is there any other system / security log I can look at? Maybe a system value?
Any suggestions?
 
Thank you 
 
 
 
 
Valerio Vincenti
IT Business Analyst
County of Spotsylvania, I.S. Department
Spotsylvania, VA 22553
Phone (540) 507-7507
Fax (540) 582-9841
e-mail: vvincenti@xxxxxxxxxxxxxxxxxx