Do you have any clue (from the access log for example), that this user’s
password
has been successfully changed after 20110606211056Z ?
Or is there any chance that the password was changed while the policy
overlay wasn’t loaded,
which could occur if it was changed on a misconfigured replica for example.