We have someone that keeps trying to connect to our email host and after a few attempts of trying to log in (incorrectly) we are then blocked. We then have to call and unblock. Less then having everyone turn off there computer and devices, is there a way to find out who it is using nmap or wireshark? Thanks for any help.
Presumably you have a NATted network, so your errant user appears to your email host as the same address as all your users.
The solution depends very much on the topology of the network. The best bet is to find the switch that's connected to your external connection (but before the NAT takes place), configure a mirror port, connect a computer to that port with Wireshark, and log some traffic. Hopefully you'll be able to capture the traffic that's causing a problem.
From Setting up a Honeypot:
A honeypot is a network, computer, or other system designed as a trap, to identify "bad people" and watch what they do, in order to learn about how they do it, so that defenses can be built against the attacks which are seen.
I recommend you to set up a honeypot server. If someone tries to use
nmap-like software on your server, redirect him to the honeypot server.