Dig in to this a bit deeper. It was not a single device roaming between two Wi-Fi, but two devices used in parallel: each connected to a different Wi-Fi!
The logs go like this during his very first login with a standard password:
11:09 logged in IP1
11:11 logged in IP2
11:12 logged out IP1
11:15 (compulsory) password change IP2
11:15 course visited IP2
I couldn't find any password rejections. So the issue could have been anything. Putting the matter on ice.