Update: the issue appears to be related to our OU structure. The accounts that aren't working are in a different OU. But we're not sure what in the OU structure would prevent their logging-in. They're all in the same sub-tree so should be found.
Microsoft so far hasn't been able to assist us - they stated to check the password on the account(s), but we can confirm they are correct.
Update: sorry, the behaviour is inconsistent. Some users can login, others can't (either via group membership or directly assigned to site).
It makes me wonder if it's related to the PortalSuperReader/PortalSuperUser accounts and the Publishing feature, but doesn't explain that some users can continue to login OK.
Our users can login to our Extranet FBA site if they've been directly assigned to the site, but not if they're assigned permissions via a SharePoint Group. The permission assigned is exactly the same. What could cause this?
The standard FBA login error is: "The server could not sign you in. Make sure your user name and password are correct, and then try again."
There is nothing in the IIS or ULS logs that I can see. (You're only logged in IIS if you have Full Control via the Web Applicaiton
User Policy and can login OR if you have no permissions and get redirected to the "Sorry this page hasn't been shared with you" page).