Two things are absolutely critical with UPS... permissions, and doing the configuration in the right order. Spence Harbar has the 'gold standard' guide on how to setup UPS... follow it to the letter.
Remember that when FIM is provisioned, it does so under the farm account, but the service should execute as another identity, and the synchronization as a dedicated synchronization identity. If the service account is changed (via Central Admin -> Configure Service Accounts) at any time after FIM has been configured and setup, you likely will need to reconfigure/reprovision UPS (it's just not very forgiving).
If you're seeing a flood of hits that result in the account being locked, it's entirely possible that the service running FIM has the wrong credentials (that's a managed account, so you can reset the password via CA). It's also entirely possible that the physical sync account (not a managed account) has either the wrong credentials, or not the correct delegated authority to Active Directory.
Are you doing one way sync, or bi-directional sync?
You can also run the FIM management console on the box running the UPS service, and review the FIM logs to see where it's blowing up.