Do you have any clue (from the access log for example), that this user’s password

has been successfully changed after 20110606211056Z ?

Or is there any chance that the password was changed while the policy overlay wasn’t loaded,

which could occur if it was changed on a misconfigured replica for example.