I followed the advice @r-a-y gave and switched my theme to Twenty Twelve, and discovered it was a bug with my theme after all. The theme had its own login form that didn’t seem to check for user verification. Fixed by getting rid of that and using the traditional WP login form!
