I assume you have check v$session looking for the offending user.

Is the offending user associated with any active jobs?

Do you have replication in place in your environment? does the user owns replication?