End users have to re-input their passwords if the mail/activesync profile updates. I wonder if the Owners of the device were changing or if the profile was updating from Systems Manager to cause this. Do you see any "profile update" command in Activity Log from Systems Manager right before end users report this? If so, maybe there is an action in Dashboard causing the profiles to get updated. It is also possible the mail server needs the end users to re-authenticate again for some reason.