"he should have remembered his password"
Why? I've got 140 username / passwords in one password vault, and I've got more in another one. Over 7 different PINs or passwords that are work related.
There is a limit to the number of PINs and passwords that you can remember, especially when the restrictions prevent you from coming up with a password that you might possibly be able to remember. And that's before you have password expiration policies kick in.
BTW who's the moron who let's the policy expire passwords on Saturdays, when you need to change the password while you are sitting in front of a computer? It's always fun when mobile email access goes away during a crisis because of the no notice password expired event.