I have been using the same credentials for many months, and suddenly I get prompted that password is incorrect and to enter correct password when attempting to connect with SSH.
Using JuiceSSH on Android. User/Pass is saved as an identity and assigned to the correct connection. Identity was not changed since it was created, using default credentials - osmc:osmc.
I assume this means that someone else is running Kodi at the remote location.
If the device has been compromised – and leaving the default password unchanged on an Internet-facing device means that this is very likely – there’s no knowing what’s running on it now. It could be a DDOS bot or a bitcoin miner.
You could ask the end users to attach a USB keyboard, exit from Kodi and press escape when the splash screen appears. Then see if they can logon with osmc:osmc.
Don’t forget, more importantly, if the device has been hacked, there is now a rogue device inside the firewall at that location, who now has ability to directly reach every system on that local network! The entire network and every device on it is at risk of compromise!