An account's name is only its local part, so leslie.ritchie in two
domains looked the same in every account picker; locking picked the
wrong one. Account options and labels now use the full address.
Management > Compliance > Locked accounts lists locked accounts and their
delegates, with lock, edit delegates and unlock dialogs that require a
reason. A person's account page shows the lock and the way to lock or
unlock it (audit-hold-lock spec AL-1, AL-5).