This command will take a long time to run (since it will examine every file in the system) but it should find the file:
find / -type f -print0 | xargs -0 grep -w 'TMOUT=' /dev/null
An alternative approach is to find out under what circumstances it is set, for example by checking whether it is set when the shell is not a login shell (env -i bash) and whether it is (env -i bash --login). You could manually check files in $HOME, for example .profile, .env, .bashrc or .bash_profile. There are also some files in /etc/ which specify environment variables; it could be set in any one of them.
If your login shell is ksh, you will find that $TMOUT is set by the ksh shell itself.
Edit: to explain some of the less obvious features of the command line above:
The idiom find ... -print0 | xargs -0 ... is quite common. The point of using -print0 instead of the default -print is that the file names are terminated with an ASCII NUL in the case of -print0. This means that filenames containing an actual newline will be correctly represented. Passing the -0 option to xargs simply makes xargs understand the same convention.
The practice of routinely passing /dev/null as the first argument to grep is also worth explaining. Since you only get end-of-file when reading from /dev/null, it will never match any non-empty string with grep. Hence there will be no hits for that file. We only specify it on the grep command line to cope correctly with the case where the final time xargs runs grep, there is only one remaining file to be searched. If grep has only one file argument, it lists the hits without specifying the command line. Like so:
~/tmp/t$ echo hello > a
~/tmp/t$ echo hi > b
~/tmp/t$ grep '^h.*' a
hello
~/tmp/t$ grep '^h.*' a b
a:hello
b:hi
