On occasion, spam filters will click on the linked token in access emails, rendering them invalid for the user. There is a manual token in the access email that should work. Note that the token should stay valid for 24 hours (or until used).