I wrote a new extension to handle the change password process.
This first release still calls mkntpwd as external program to build the NT and LM hashes, but now it doesn't require rebuild of zimbrastore.jar because it's just an installable extension.
I followed the hints suggested in the changepasswordlistener.txt and extensions.txt files, found in \ZimbraServer\docs inside the zcs-5.0.2_GA_1975-src source package.
I'm going to make some other test and then I'll post the results, and the code.
It seems to work as expected, right now.
2008-03-09 07:32:23,857 INFO [main]  extensions - Initialized extension sambaextension: com.zimbra.samba.SambaExtension@com.zimbra.cs.extension.ZimbraExtensionClassLoader@16daa9
from audit.log (with '123456' as new password):
2008-03-09 07:50:36,083 INFO [btpool0-2] [name=zimbra;ip=127.0.0.1;] security - cmd=ModifyConfig; zimbraPasswordChangeListener=samba;
2008-03-09 07:51:22,972 INFO [btpool0-0] [ip=127.0.0.1;ua=zclient/5.0.2_GA_1975.RHEL5;] security - cmd=SambaChangePasswordListener.preModify; lmPassword=44EFCE164AB921CAAAD3B435B51404EE;
2008-03-09 07:51:22,972 INFO [btpool0-0] [ip=127.0.0.1;ua=zclient/5.0.2_GA_1975.RHEL5;] security - cmd=SambaChangePasswordListener.preModify; ntPassword=32ED87BDB5FDC5E9CBA88547376818D4;