We found out that the password requested by the System Restore function was looking at an older password version from the user. In this case the user had to use a password two password changes back in time. In our case that was a password of two years ago.
Besides this we found out no system restore points were created for this user. Possibly is this the reason why the functionality did not actualize the windows password for the user was well.
At least this answers the question this System Restore functionality is not looking at the up to date online status of a Windows account but at a local mirror of it that can get out of sync.