We are having the same issue, the proposed "workaround" (which we found) is to go into the customer, remove access, add access and set a new password, we told support we could not do this because we have 8.000 customers under this condition (and it keeps growing), I'm currently working on catching the exception and generating a custom recovery password form that will essentialy do what the workaround does and set the password to the customer that he desires so we take off the work of our customer care people.