The next time a user reports this - have them go to
https://whatismyip.com and provide you their Public IPv4 address. Check to see if that IP is listed in the IDS blocks, they might be getting blocked intermittently which would present as failed authentication until the IDS block dropped out.
Kyle Kerst
IT Coordinator
SmarterTools Inc.
www.smartertools.com