How could one gracefully and empathetically tell a frustrated coworker that her inability to login is actually her using an incorrect password?

FTR “Nope, not the system, you keep messing up” is not graceful.

“Server logs indicate credential mismatch. Check your password here.”