I'd never run an AUDIT listing before (yeah, I know, long past time), so I figured it out today. Turns out my coworker created the ACID; he used to be a mainframer but nowadays he usually works on other things, so I didn't expect that. The VSUSPEND was added—according to TSSAUDIT—by the victim herself:
CHANGER DATE TIME SYSID TYPE COMMAND/IMAGE
ENHRS01 07/17/17 13:28:21 KMC1 PW TSS REP(ENHRS01 ) PASSWORD(???????
ENHRS01 07/17/17 13:47:29 KMC1 CMND TSS ADD(ENHRS01 ) VSUS
I would normally suppose that's a little TSSAUDIT fiction that means she did something to incur the suspension—but as I said, TSSUTIL claimed (and still claims) there were no violations by her ACID during that time period. So still puzzling, but I know more today than I did a few days ago.