I manually reset the user in question’s password, so that part of the issue is resolved. This problem apparently only exists for icloud.com email addresses; I was able to reproduce it with an icloud email address. I thought perhaps that icloud might have been blocked as a spammer in the way yahoo email addresses are, but that doesn’t seem to be the case, and the icloud.com address can receive emails just fine (including password reset emails) from the THATCamp system — apparently it’s only password reset tokens that don’t work.
If any other users encounter this issue, please either use a different email account with your THATCamp user account or else write chair at thatcamp dot org to have your password manually reset. Pardon!