It shouldn't be a permissions problem because I managed log into his account (in incognito mode) in Management portal with the password he provided! Then I made a test user with the same permissions and logged in with it.

But he couldn't log in with either and the Audit log entry is the same for both, no matter which user he tries to log in as: "Error message: ERROR #862: User is restricted from running application /csp/sys/op, %Admin_Operate:U required -- cannot execute." Somehow we do the same thing and get different results.

(edit) I will try the second avenue you wrote about, thank you. If that doesn't bear fruit, we'll see.

(UPDATE) Solved, thank you Nick! After some further digging, it turned out that indeed it was a different colleague sent him the link to check out one of the systems monitoring pages for some reason. He indeed doesn't have permissions to access it! He just panicked and assumed nothing was working when that particular page wouldn't admit him.