He mentioned that he does and the password manager didn’t prompt to autocomplete the password automatically, so he had to force it.

The thing that should have saved my bacon was the credentials not auto-filling from 1Password, so why didn’t I stop there? Because that’s not unusual. There are so many services where you’ve registered on one domain (and that address is stored in 1Password), then you legitimately log on to a different domain.