The check for this parameter was missing from BusyBox.modify_user(), resulting in unexpected password changes to existing user accounts.
Sam Doran