Hi Vinay,
in SAP ABAP systems with Basis 7.31 (7.03) and later, there is the ability to assing security policies to users which are not based on the profile parameters. There profile parameters are only the default. In such systems it may be that the profile tells expire=30 but the profile assinged to the user might tell something different.
BTW: could you please check the value of login/password_change_waittime? it should be 1 or at least less than 30.
If your SAP basis is elder than 7.31 and the user can login in via SAPGUI with username and an expired password without being required to change his password and he is a dialog user, I would suggest you open a support ticket.
Regards,
Patrick