From what I understand he no longer has access to his old email address, and was in the process of changing it to his new email address. Now he cant log in with his old email address, and the new email address has not been sent the authorization.
I resent the aurthorisation, and although it appears its sending it to his new email address, it simply sends an email to the old email address.
Removing their mod status should mean they no longer have to confirm their old email address and only need to authenticate their new email. Could you check your require change email confirmation admin setting and see if you’re asking non-staff to also perform this security check?