I'd be tempted to watch them change their password, just to make sure they did in fact complete the steps. I'd expect it's more likely that they tried to change their password but it was rejected for some reason and they didn't catch it.