one of our users can't login to zimbra... it's been working well, no account changes we're made, but now after trying to log in the error is

Permission denied

and the description is

Code:
msg - permission denied: you do not have sufficient permissions
com.zimbra.cs.service.ServiceException: permission denied: you do not have sufficient permissions
	at com.zimbra.cs.service.ServiceException.PERM_DENIED(ServiceException.java:204)
	at com.zimbra.cs.mailbox.Mailbox.checkAccess(Mailbox.java:1799)
	at com.zimbra.cs.mailbox.Mailbox.getItemById(Mailbox.java:1808)
	at com.zimbra.cs.mailbox.Mailbox.getFolderById(Mailbox.java:2411)
	at com.zimbra.cs.index.ZimbraQuery$InQuery.Create(ZimbraQuery.java:683)
	at com.zimbra.cs.index.queryparser.ZimbraQueryParser.GetQuery(ZimbraQueryParser.java:156)
	at com.zimbra.cs.index.queryparser.ZimbraQueryParser.Rhs_Text(ZimbraQueryParser.java:362)
	at com.zimbra.cs.index.queryparser.ZimbraQueryParser.Clause(ZimbraQueryParser.java:681)
	at com.zimbra.cs.index.queryparser.ZimbraQueryParser.Query(ZimbraQueryParser.java:846)
	at com.zimbra.cs.index.queryparser.ZimbraQueryParser.DoParse(ZimbraQueryParser.java:919)
	at com.zimbra.cs.index.queryparser.ZimbraQueryParser.Parse(ZimbraQueryParser.java:229)
	at com.zimbra.cs.index.ZimbraQuery.<init>(ZimbraQuery.java:1721)
	at com.zimbra.cs.mailbox.Mailbox.search(Mailbox.java:2731)
	at com.zimbra.cs.operation.SearchOperation.callback(SearchOperation.java:73)
	at com.zimbra.cs.operation.Operation.schedule(Operation.java:190)
	at com.zimbra.cs.service.mail.Search.handle(Search.java:72)
	at com.zimbra.soap.SoapEngine.dispatchRequest(SoapEngine.java:261)
	at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.java:162)
	at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.java:84)
	at com.zimbra.soap.SoapServlet.doPost(SoapServlet.java:223)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:709)
	at com.zimbra.cs.servlet.ZimbraServlet.service(ZimbraServlet.java:173)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:802)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:252)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
	at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:541)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
	at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869)
	at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:667)
	at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
	at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:80)
	at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:684)
	at java.lang.Thread.run(Thread.java:595)

code - service.PERM_DENIED
method - ZmCsfeCommand.prototype.invoke
detail - soap:Sender
any help???