passwd -S user_name one can find out, if an account is locked, but is there a way to find out when it was locked and who it locked?
Currently, yes and no. The security system itself doesn't log historic details of password changes. Since it's a flat file it would be hard for such a record to be accurate and trustworthy, if access to the databases had to exclusive go through some kind of a broker then it would be possible (you could just add the logic to the broker), but with widely accessible flat files, not so much. This is why a lot of LDAP/Kerberos identity services allow this type of auditing but local unix users have a hard time with it.
The closest you can get is to enable operating system audit logging, log all command executions (with command line options) and watch the
To clarify, the default
You could go through your system backups, looking for two consecutive backups (N and N+1) where the user is locked in