If your client's account password has expired, they will receive an Access Denied if the global account policy User must log on in order to change password is set.

Disable the global account policy User must log on in order to change password
in User Manager (for Domains) / Policies / Account.