That's solved by clearing the account's password field when locking it. The absence of a password could even be the flag that indicates an account is locked.