is it just an assumption that he has no authority by looking at his roles ?
have you asked him what message he gets if he executes ME01 ?
you know that the user master has 2 change logs? one for the user master itself and another one for role assignment.
Further you would also need to check if any role he has got changed, as this cannot be seen from the user change logs.