Someone is manually Temporary Allowing IP without Root Access

There are 20 hosting account in our server. someone is manually allowing ip in firewall without root access. every time, I delete Ip, new one appear.

how to resolve it?

same here.. where does it come from? is there a way to do it from client panel?

Are you talking about CSF, not Mod Security?

they are doing that via their own user panel, its one of your users