That's what I initially thought too (and may still) but how can you explain that it only does this when the account has been properly built once. That is, if you enter the email account into the phone after a restore and/or if it has never been entered into the phone, the bogus password will not validate as you would expect.
It is almost as if the iPhone remembers only the validated password and does not completely delete the account?