Welcome to the forums,
How about if they try to change the password using the standard (HTML) web-client? Don't forget to update your profile with your version information so we can better assist you when you have questions. Several methods of finding your version info are also given at that link.
This is fixed in 5.0.2:
Bug 21246 - When using https: Change password is broken in WebUI >
Bug 23553 - Mail> Change password broken(always tries to open https) even when it we have http url
A new window method had to be used for
Bug 10981 - Setting password should happen over https when login is done over https in mixed mode, thus the standard (HTML) client's change password page is what's used - this also eliminated the need for ZmChangePasswordDialog.