Sandy's use of MacSFTP to connect to our server, for some unknown reason, was causing a PAM authentication failure - even though it would log him in fine.  Since I installed fail2ban to protect the server against SSH script-kiddie attacks, he got banned a couple times since a line that said "Authentication failure" popped into the log everytime MacSFTP connected to the server.  He's switched to fugu, which didn't cause an authentication error in the logfile.