There is a difference in getting locked out (temporarily, expires by default after 15 minutes which is configurable) or getting banned (permanently).
Likewise there are different places in the iTSec plugin UI where you can release/undo lockouts/bans.
It seems you’ve already found where to undo permanent bans, but you haven’t yet figured out where to release lockouts.
Lockouts can be released (before they auto expire) from the Active Lockouts side widget. Simply navigate to the Security/Settings page and notice the bunch of advertorial side widgets on the right of the page. Now scroll down and you’ll find the Active Lockouts widget somewhere buried among those advertorial widgets. Usually the widget is empty. If your site is as busy as you say it is there is a good chance your widget will show some lockouts. But remember lockouts do also auto expire …
Also note there have been significant changes to the lockout API in a recent plugin release (for details read the Changelog). Usually new code also introduces new bugs.
To prevent any confusion, I’m not iThemes.
