Changed exchange password - When will it prompt the cellphone?
While I am not 100% sure, I do remember that this was a thing that would happen, either a function or "bug". The issue, if you want to call it that, lies within AD (active directory), or the authentication process of your account. Exchange server will get your credentials from AD, and AD might let you use your old password for a while after changing, before it finally will reject your old password.

Of course, this will likely boil down to what server systems are at play, but it is a known "bug" that we've experienced at work. It should however not be a security issue as long as the user is the only person who know the passwords.