But the above log entry is giving indication that you have some automated process running that is changing passwords.
2012-11-22 11:45:06,121 INFO [btpool0-37032://localhost:7071/service/admin/soap/SetPasswordRequest] [name=zimbra;ip=127.0.0.1;ua=zmprov/7.2.0_GA_2669;] security - cmd=SetPassword; firstname.lastname@example.org;
You mention AD. Could it be coming from another system on your domain?
Ben Franklin quote:
"Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety."