In the BES, if you look at the status, does it show the correct PIN?
Can they send email? If not, and they get an encryption/decryption error, downgrade the desktop manager to 3.6 (www.blackberry.com
is where you can get it if you need it) and generate 3 encryption keys manuall.
On the desktop, with the BlackBerry plugged in, open the redirector and send a message to the user...does the pending or delivered go up?