This is something that happened to me last week until I found out that they hadnt gone to the domain squirrelmail (
www.yourdomain.com/squirrelmail) but instead they had actually gone to the squarrelmail site and was trying to login their which obviously told them they had incorrect details.
Might be worth double checking they are actually going to their domains squirrelmail and not the actual squirrelmail website.