[Ben L.]

I don't see how a user could both be logged in AND have a broken password. If their password is broken, they can't login.

Maybe they were still logged in while they got blocked.