...
not activated their new account in time (within the 48 hours of creation)
they have forgotten their password
they have replaced their mobile phone and not transferred the authentication details to the new phone
their password has been compromised and they are unable to reset it themselves.
...