The requirements could have changed since the user last set their password.