There is one custom program that creates BDC session to change user data - using SU01 transaction.
It changes last name, first name and cost center. However Basis did notice that when this program was running, some user's passwords are also changed even though there is no code related to password fields.
Unfortunately this is happening in production only and intermittently. If any one has come across this kind of problem, please reply.