Cant say I can decipher what this means. This is happening all day in my zimbra.log. 7071 is not even open to the web not sure how this is happening. Any questions feel free to ask. Users account was getting locked out ever 5 min so I had to disable the lock out for now.
Apr 2 15:47:29 mail saslauthd: auth_zimbra: email@example.com auth failed: authentication failed for [firstname.lastname@example.org]
Apr 2 15:47:29 mail saslauthd: do_auth : auth failure: [user= email@example.com] [service=smtp] [realm=domainalias.com] [mech=zimbra] [reason=Unknown]
Apr 2 15:47:29 mail saslauthd: zmpost: url='https://mail.domina.com:7071/service/admin/soap/' returned buffer->data='<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"><soap:Header><context xmlns="urn:zimbra"/></soap:Header><soap:Body><soap:Fault><soap:Code><soa p:Value>soap:Sender</soap:Value></soap:Code><soap:Reason><soap:Text>authentication failed for [firstname.lastname@example.org]</soap:Text></soap:Reason><soapetail><Error xmlns="urn:zimbra"><Code>account.AUTH_FAILED</Code><Trace>qtp1062592280-2154:https://184.x.x.x:7071/service/admin/soap/:1396468049971:e95afb36fdf2e045</Trace></Error></soapetail></soap:Fault></soap:Body></soap:Envelope>', hti->error=''