I had the same problem and I solved it by using todd_dsm tip but instead of an absolute path I used a relative since I don't know what domain name the user logs in from.

[root@mail ~]# su - zimbra
[zimbra@mail ~]$ zmprov mcf zimbraChangePasswordURL h/changepass
[zimbra@mail ~]$

The pop-up window now displays the correct url.