That's definitely strange... Sorry, haven't seen this before myself.
A few things that may help with debugging though... apologies if you already know of these steps, I'm not sure how much drupal debugging you've done before.
It sounds like this user can never log in normally. So I would change their password yourself (since it's irrelevant to them) to something you know, and try to reproduce this yourself firsthand. This will also let you test solutions. I mean, probably tell them first. :)
Check the drupal log (/admin/reports/dblog) to see if anything helpful shows up there.
If you can, disable related modules until you get it to work. Then you can investigate the particular module(s) in question.
Think about if anything would have changed in the system around when the problem started. Were modules updated or added? Did the user's situation change?
Google for the problem. For example this issue report came up when I did a quick search. You might find someone else with a similar issue with a particular combination of modules that you also have.
Also, if you have modules in mind, you can search through their history of issues. For example, for tfa:
Similarly, you can also try updating modules. Either to newer versions (if some modules are out of date), or you can try updating certain modules to the latest dev version instead, where newer code will exist but not be in an official release yet.
Good luck and feel free to reach out more if needed. :)
Martin Hansen Senior Consultant / R&D Lead 519.725.7875 x2120 | 888.817.3048
PeaceWorks™ Technology Solutions 101 - 554 Parkside Drive, Waterloo ON N2L 5Z4 www.peaceworks.ca
Mission driven technology solutions
This communication is intended for only the party to whom it is addressed and may contain information that is privileged or confidential. Any other distribution, copying or disclosure is strictly prohibited and is not a waiver of privilege or confidentiality. If you have received this telecommunication in error, please notify the sender immediately by return email and delete this message from your computer.
Please note: If you do not wish to receive promotional emails from us, please reply to this message indicating your preference and we will refrain from sending further promotional emails.