I have a feeling that somehow you have you SAML implementation overriding usernames, so when they re-auth, we take the name provided by SAML.
I would check saml_clear_username
or auth overrides username
settings.
2 Likes