If they change their email and you have the email verification configuration on, they'll have to check their emails to get the new password (this is to prevent them from using fake email addresses)...