Should have sent a email to unlock/change password when he tried to log in