Good Afternoon Sean,
Great points and I believe this below is what your experiencing. Try checking the values set in GSO for the PSWD to see what the values are set to for PASSLMT and MAXTRY. And also check the values in the CICS Region parms.
Specifies the maximum number of invalid password, SAF Kerberos key and password phrase attempts permitted in a single day before CA ACF2 denies all accesses to the system by the logonid. For example, if the maximum number of invalid password attempts is two, CA ACF2 denies all access attempts after the second invalid attempt. If you try to log on after the PASSLMT has been reached, you receive a message telling you that your logonid has been suspended.
NOTE: If the GSO PASSLMT field of the PSWD record is reduced, users can be suspended if their PSWD-VIO count is equal to or greater to the new value. For example, if PASSLMT is reduced from 5 to 3, logonids are considered suspended if the PSWD-VIO field in those logonids had a value of more than three.
Using an Invalid Password
If the terminal operator supplies an invalid password to a prompt other than sign-on, the CICS interface prompts the terminal operator for the correct password until the OPTION MAXVIO or the GSO PSWD record PASSLMT value is reached. When the limit is reached, it signs off the terminal operator. If SUSPEND PASSWORD=YES is specified, the SUSPEND logonid field is set. The CICS interface disposes of the terminal according to the specification of the OPTION DISCONNECT parameter. The host system does not count password violations as a result of password verifications after sign-on.