A user forgot their password. I have admin rights in the org so I reset their password. They then informed me that they have also forgotten the answer to their secret question.
I know that you can navigate to your own user settings and change your secret question and its answer, so I logged in as her through the user list as described here. Unfortunately your old password is also needed to change this.
The user has also tried several combinations of answers with lower case and upper case letters.
I've found a few articles like this that don't give much information about resetting the security answer - "If you do not remember the answer to your secret question you should contact your System Administrator".
Please note this is also in a sandbox environment so if I'm totally out of options, as an alternative I can delete and recreate the user, but I'd rather not.