I should have mentioned I added the new user to the AD security group about a week before they tried to access the SQL database.

Wouldn't this have given them...