I thought of that, but we have a really bad AD/Mac setup where changing your password takes 30-60 minutes to propagate. During the time you try both your old and new passwords until they work.

If you try to change it again during the 30-60 minutes propagation time, then you need to try even more passwords passwords. Too complex to deal with.