Have you confirmed that it is a session issue? I would’ve thought that sessions linked to that password get killed automatically on password change.
Keep in mind that a password change won’t affect the App-passwords. If the user connected his iPhone via the Connection-profile with App-password, which you can download on the mailcow-profile page, mailcow will have created an App-password just for that connection. So it would make sense that the connection is still possible from his iPhone.