This is why you must use app passwords (in users mailcow UI). When configuring the email client you create the app password for that specific client. Do not write it down or store it. If you need to configure the email client again, just create a new app password.
That way client software will be independent from Active Directory passwords (and its enforced changes), which will only be used for accessing mailcow UI.
Think of the app passwords as an access token with unlimited validity. As it is never entered again, it is not prone to phishing attacks.