Check cmn_sec_users.user_status_id for account status.
You'll find 3 numbers there: 200 (active), 201 (inactive) and 202 (locked).
Used to be more clear, IMO, in days gone past, where resources were placed on projects and users were people that logged in - back then, on Application side, one would find "Resources" as everyone sees them today. On Admin side, instead of "Resources" one would see "Users" - I think this terminology was more clear and lined up with the table names better.
Dale