Just had a long and excruciating call with the folks but have finally got them logged in again through a combination of trial, error and sheer luck. I'm worried that whatever caused the issue might happen again though, so perhaps somebody could throw some light on the following:
I got them to do a Ctrl-Alt-F1, login at a console and type 'startxfce4', which they say produced this output:
Creating new authority file /home/abcde/.Xauthority
Fatal server error: server is already active for display0. If this is no longer running, remove /tmp/.X0-lock and start again.
(the above 'display0' and 'X0-lock' might contain different characters to what I typed)
After an ineffective switch to Ctrl-Alt-F7 and back to F1 again, I then took the chance of having them log in as root and typing 'shutdown -r now', after which they got back to the GDM login with the usernames. So does that shed any light on why how they got locked out in the first place?