It’s hard to say for absolute sure as I’m not familiar with all the details, but it is possible to see a TL3 Requirements page with red on it yet the user is still currently TL3 (based solely on the automatic behaviour with no group or manual TL adjustments).
Glancing over their activity stats in the user directory may show more activity than you were expecting, or possibly a deeper dive with a data explorer query.
Double-checking their groups may show a cheeky one with an accidental TL3 bump.
If they were an invited user you could check the Default invitee trust level and its history to see if that was ever erroneously changed to TL3.
You could also check to see if any of the TL3 requirement settings were ever changed to loosen them up before being changed back again.
Some of this will be more kicking the tyres, but could be worth checking just in case. 