The user should reset the password with their account provider e.g. Google.
If the user loses access to their password AND all OTHER security information, they will not be able to regain access to their account. This is a security measure. The user will need to re-authenticate with a different account.