This Warning message is produced by Oracle login module when IFS Users with expired Oracle user passwords try to log into IFS. 
If you need to stop this messages from appearing in logs, make sure that the expired Oracle accounts are either locked, are deactivated or they’re provided with new passwords so that the accounts are opened.

So, having these Warning in the logs is fairly normal and you only need to worry if a particular User is complaining that he is failing to login to the application. 

Hi @ctoniazzo ,

By just looking at the provided warning, It is not possible to say that what is the exact cause for the issue and it requires detailed log analysis. Things you can try out are;

1. Bring the ManagedServer log level to a high level : Debug(Contains More details) level for a short amount of time and  analyze the logs. After analyzing, mostly you will be able to find what is the account and the  IP of the user/machine which is trying to login with incorrect credentials.
2. Furthermore, that above mentioned IP could be a Reverse Proxy server or Some other server. In that case mostly the incorrect login attempts should come from the user through a particular module. By tracking the logs related to the RP server or the module, you would be able to find the root cause.

Hope this helps!

Cheers!

Jeewaka.