Workgroup Manager/Remote Desktop Access/Keychain issue

We run AquaConnect on our 10.6.7 server, adding users through Workgroup Manager. They all have pretty limited access accounts - just Mail, our database, Safari. When one user tries to set up Mail, he gets the message that "A Keychain could not be found to store [username's email address]."

I tried enabling his account to give him access to everything (even made him an administrator) and logged in as him to try to reset the login keychain - there is no login keychain!. I can't seem to create a new keychain (got an error when I tried that). And keychain first aid doesn't actually bring me to the window where I can do anything (I get a preliminary screen with a bunch of tickboxes). Is there some way I - as the administrator - can reset an individual user's keychains?