This morning we started having issues with users saying they could not
login. Error msg was to the words of "account is disabled..."
When I checked all the accounts were disabled and re enabling them was a
pain as I had to click each tick box and save twice for each user as they
would only get enabled on the second save.

Any explanations of this and how/why it happened?

Luckily we only have about 15 test users using it so far - if all our users
had migrated to 3.8 it would have taken days to re enable all the accounts.