The customer is changing it from the "Forgot login" link in the CB Login module.
The "Access Denied" message is in the error module on the forgot login page. It occurs after they click the box and fill in the form:
When I go to Menus I see the "CB Forgot Login" is published and public. It's in a menu called Community Builder. I don't have a module or position for this menu - I assume it works like the "hidden" menu we used to create in the old days (Joomla 1.0, 1.5) for some pages (like contact forms) to work.
Could this have something to do with Akeeba Admin Tools? I added "index.php?option=com_comprofiler&view=lostpassword" to the .htaccess maker exceptions list, but that did not fix the behavior.
Thank you,
Ernie