After changing his domain password, a user may not be able to access CRM (Outlook or Web Client) without first being prompted for his username and password. This seems to occur if the user had to previousely enter a username and password to access CRM because he was not connected to the domain during login (i.e. a remote user connecting through a VPN) and that user selected the option to save the password to the password list. From that point forward, it seems as if CRM will use that cached password for authentication instead of the actual domain credentials provided during logon. When the user changes their password on the domain, it creates a discrepency between the password in the password list and the actual password needed to authenticate with CRM, resulting in the prompt for credentials.
To resolve this you can attempt to access CRM via the web client and when prompted for credentials, check the option to save to the password list. This will effectively replace the previousely cached credentials with the new ones.