Password may contain illegal characters
From the Login Toboggan config page: 


  LoginToboggan automatically performs basic password validation for
  illegal characters. If you would additionally like to have a minimum
  password length requirement, select the length here, or set to 'None'
  for no password length validation.


If you check the logintoboggan_validate_pass you see: 

  if (preg_match('/[\x{80}-\x{A0}'.          // Non-printable ISO-8859-1 + NBSP
                   '\x{A1}-\x{F7}'.          // Latin punctuations
                   '\x{AD}'.                 // Soft-hyphen
                   '\x{2000}-\x{200F}'.      // Various space characters
                   '\x{2028}-\x{202F}'.      // Bidirectional text overrides
                   '\x{205F}-\x{206F}'.      // Various text hinting characters
                   '\x{FEFF}'.               // Byte order mark
                   '\x{FF01}-\x{FF60}'.      // Full-width latin
                   '\x{FFF9}-\x{FFFD}]/u',   // Replacement characters
                   $pass)) {
    return t('The password contains an illegal character.');
  }


So your problem comes from Login Toboggan.

I think this automatic validation is only performed when user can set the password int he register process.