Could this be because at login Windows prompts for a change of password and once they do, it proceeds with logging them onto Windows yet the OS is still using caching old network login and toggling both passwords at this point.? This happens to us often when their password expires and all I do is have them restart their workstation and once logged in to the OS with the newly created password it authenticates the new password and Credential Manager now holds that new information. Only then will MDM sync to the mail server as the new password is now fully authenticated.