Yeah, they VIP that I was helping when I encountered the above issue was not using a pw manager and the device in question had been replaced (by the org) a bit more than a year ago. We also had an insane pw policy at the time that made users change them every three months, so good luck remembering. So grateful that madness is over.