Answer
This is controlled at the Oracle level, not an IFS-specific per-user setting — check the Oracle Profile attached to the user's database account (visible from the Oracle Users administration window), specifically the 'Failed Login Attempts' property defined on that Oracle Profile. Since Oracle Profiles are typically shared across many database accounts, the allowed-attempts threshold is really a property of whichever Oracle Profile a given user's account is assigned to, rather than something configured individually per user.