Passcode for restoring end-to-end encrypted data on iPhone not working

Hi,

I've been resetting iPhones to factory settings (Erase all data), and after they come back up they are being set up as new devices for the same users. When the user signs into iCloud, they are asked for the passcode for the old phone, to restore end-to-end encrypted data.

However, when the user enters the most recent passcode they were using, it tells them it's incorrect. When they try an old passcode they've used before it accepts this.

The devices are company-owned, and pre-restore were managed by MobileIron, which I believe gets them to change their passcode regularly.

Is Apple not storing what the passcode is after MobileIron gets them to change it, and does this mean they have to remember what the passcode was when they set it up years ago? Or is there some other issue I'm missing?