Usually this only occurs when they change their password without using Ctrl+Alt+Del to do so. They then have to use their old passphrase once to get past Bootguard, and the SSO mechanism tries to pass those credentials to Windows.
When it fails to authenticate to Windows, the Windows login screen will show PGP SSO as a user that tried to log in, basically it's just the name of the proxy passing the credentials.
After they log in once successfully, the passphrase should again be synced with Bootguard.