We have had problems with passwords in WinCC Flexible. Here is an example from Siemens that could help.
http://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&lang=en&objid=24141925&caller=nl
http://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&lang=en&objid=24141925&caller=nl
Description:
If a user enters an incorrect password three times in succession, that user is entered in the "Unauthorized" group in the user administration. Only a user with administrator rights can reassign that user to a user group. How can you avoid "incorrect inputs"?