That is usually one of two things, both having to do with the firewall.

If they have their email reader set to automatically check email every minute they may want to change that to every 2 minutes, or use IMAP instead of POP3.

OR

They did something wrong and used the wrong username/password more than a few times in a row (in email, or some other area of the site, log cpanel login, or anywhere else they can enter a login on the server) which has resulted in the server firewalling their IP.

Both are temporary blocks, that is why it "comes and goes" as you say.