Especially for sites that force change the password way too often, as was once thought of as a good idea.

Try Kerberos.....That will likely avoid that issue...

Alternately, check to see if the user's "ZCM Auth Server" is pointing to the Local AD Controller where the password gets changed.  In some cases it may take a while for AD to replicate password changes so if the Auth Server is not pointing to the local AD Controller it may take a while for the remote AD Controller to get the new password.  Kerberos avoids most of the Password issues.

They don't. They just reset the password and users once a year. (School)

There is only one DC. And as it happens 100% with every user, I'm quite certain thi is something ZCM somehow can't deal with.It seems to attempt to login with the original password after it already got changed. And that's a bug in my book.

I'm not sure I want to open that can of worms with kerberos... Maybe next year. ;)