If the user might have gone to disable state after multiple wrong attempts, resetting the password might not help. We would have to re enable the user from Airwave DB. I would suggest to open a TAC case so that they can take the root access and take a look.