Perhaps install the Master Password (or better yet, encrypted master password) contribution and log in "as" your customer and see what exactly they've got set up ... and perhaps reproduce the problem.