login system - user password being updated

Are you saying that after the update_attribute the password field is also changed? If so do you have some sort of filter that might be running and changing it? Possibly you could put debugger traps at each point you change the password and check it is not getting there. Also have a look in the log to see what sql is being executed and if there are any unexpected write queries.