The solaruser.user_user table has an enabled property, which implies that setting that to false would prevent the user from being able to log in, and also all security tokens associated with that account would stop working as well. That is not currently the case, however.

Update the relevate user authentication queries to take into consideration the enabled property of the associated account. This should include both UI login and token authentication, including the authentication used by SolarFlux (database stored procedures).