User Admin role gives access to user table and so as the table columns. There is a write aceess to user table and also write access to some of the fields of the table. Hence user admin role can change password. If you want to restrict that, you can make password field as read only with the help of access control list or ACLs
For more info, check on wiki for ACL
