The WTOR is what tied up the security tasks. TPX has a limited number of security tasks and anyone on that task that is waiting, for the WTOR to be replied to, will be hung up. At that point the security product has control of the logon process. TPX is the victim.
A force disconnect out of the emulator is not a recommended option, simply because at that point it is up to the emulator to notify VTAM that the session has terminated, not TPX. Therefore, the users that force disconnected could not logon because VTAM had not yet been notified to clean up the sessions and from VTAM's perspective the sessions were still active.
In order to overcome the WTOR condition, it is recommended to either set up security so it does not issue a WTOR or set up automation to respond to the WTOR because TPX will not respond to WTORs and a hang condition may result.
Possible RACF messages:
ICH301I MAXIMUM PASSWORD ATTEMPTS BY SPECIAL USER userid {AT TERMINAL terminalid}
ICH302D REPLY Y TO ALLOW ANOTHER ATTEMPT OR N TO REVOKE USERID.
ICH303I INACTIVE INTERVAL EXCEEDED BY USER usrid (AT TERMINAL termid).
ICH304D REPLY Y TO ACTIVATE USER OR N TO REVOKE USERID userid.