Yeah, this is my question exactly. I've dealt with MANY race conditions over the years and the idea that two different user requests could update the same user account password seems... unlikely at best. Not saying it's impossible, but more detail would have been appreciated.

I've seen this before in a Java system. A MVC Controller populated the HTTP params into a Bean, which it assigned to an instance field, and then used that subsequently to grab the value to update (don't think it was password, might have been email address iirc). This would work fine if the controlled was request scoped, but it turned out to be a singleton - so the field was shared across all requests!