in src/main/java/org/apache/sling/jcr/jackrabbit/base/security/MultiplexingAuthorizableAction.java [94:99]
public void onPasswordChange(User user, String newPassword, Session session) throws RepositoryException {
log.debug("Password changed for user {}", user.getID());
for(AuthorizableAction a : getActions()){
a.onPasswordChange(user,newPassword,session);
}
}