IT unlocking accounts

For some unknown reason, our IT department can no longer unlock accounts and their names were removed from “Other Users” in eCW Administrator setting, to be able to hard reset passwords.  I added them back in and they can now hard reset, but not unlock accounts. 
I’m pretty sure the setting is Manage Security, but that also gives them the ability to change any security settings for any role, which would be a disaster.  Is there another setting?  I could have sworn they could go got File/ Security Settings and Unlock accounts but had no access permissions to the security settings!  Our IT team doesn’t know eCW and does nothing in the system, so concerns they could change something and we know that can break just about anything….
thanks