OpenAM "Forgot Password" makes the user change their password twice, if the OpenDJ Password Policy includes "force-change-on-reset"

OpenAM's "Forgot Password" functionality allows the user to set a new password without authenticating - the password change counts as an "administrative" password change. When the user logs in with their new password (which they just set), they are made to change their password again.