Given the presumed value of resources or applications which the user is being vetted for access, it is reasonable to live with the risk of a potential DoS on the user's access account, in order to assure that the authentication system fails safely, denying access, when under attack. Michal, you may indeed have discovered some statistical correlation that I can't see in the few numbers you provide. This second post isn't much better. When you claim that ActivCard's tokencodes are not random, you strongly suggest that ActivCard's DES implementation is severely flawed. Doubts are healthy.
Curiosity is healthy.
Calls for further study are practical. That may merely indicate your youth or inexperience, or it may have something to do with the fact that English is probably not your native language. Unfortunately, those researchers can only speak about their analysis of the tokens they have at hand. If they don't find anything untoward, they will likely remain silent. Only you can document the series of ActivCard tokencodes you worked on, and explain the assumptions and procedures you used to so accurately predict future token-codes.