This is the number of blocked requests attributed to a specific user in the top-blocked-users table. A count here that's an order of magnitude above every other user in the table is what turns a routine top-ten report into an actual investigation trigger, since normal browsing, even against policy, rarely generates that volume of blocked hits compared to automated or malware-driven traffic. For example, one user's count of 15,000 blocked requests in a day, versus the next-highest user's 40, would strongly suggest that user's machine is infected rather than simply browsing disallowed sites.