Some Android devices using the native ActiveSync email application will periodically send a recovery password to the server without end user interaction.  This is an issue orginating with the device and has been observed on the Droid RAZR M, though other devices may also be affected.

Administrators will notice this occurring if they are using the Compliance Manager to monitor the Event Based Alert, "Recovery password requested by device."  Each time the device sends a recovery password to the NotifyMDM server, this alert would be triggered if enabled.