Last week my user account was constantly locked out after 4hrs. I had just changed my password and I immediately guessed there most be some service somewhere for which I had used my account, but where. First I searched through the Active Directory and did indeed find the account lock events, but they only told me that the server SSO-003 had locked my account, which is the SSO server to which multiple vCenter Servers have been connected. I then dove into the SSO logs, but they would only show the failed attempts by my user but not where the attempt was coming from.
Through some help of the vExpert community I got the tip from Marcus Puckett to check the vCenter Server events in the Web Client. And there it was. Go to the vCenter Server in the webclient, click on Monitor -> Events and search through the events for the username. You should find the error of the login with the userID and source IP address.
PS: I noticed that in a different environment, where the client was accessing vCenter Server through NAT, the address displayed was (of course) that of the NAT firewall.