A few times when I've had a rule go crazy I've rebuilt the rule and the issue fixed itself.
Also, this might be obvious, but in group policy there is a setting for AD account auto-unlock period, I think the default is 30 minutes. I thought I'd bring this up just in case its getting auto unlocked before you have a chance to respond to your LEM Alert.