If his password or email is wrong, then he either made a typo, or is blocking cookies. There's no reason why it would say that if he had cookies enabled and typed his password correctly.
Tell him to make a new account and see if that works. If it does, I'll just delete the old one and attribute the one post he made.