Symptoms
After deploying Exchange 2010 according to the POA Hosted Exchange Deployment Guide, the Change Password button is available for all users in Outlook Web Access (OWA). This could lead to passwords in POA and in Active Directory to become out-of-sync.
Cause
The issue is caused by improper OWA site configuration.
Resolution
Disable the Change Password button for all users - execute the following PowerShell command on each OWA site:
Set-OwaVirtualDirectory -identity OWA_FOLDER_ID -ChangePasswordEnabled $false