Cisco Unity installation sets the minumum password value to three. If that value is changed to another value (for example, X), the subscriber is prompted for the password length to be X.
If the value is changed back to three or another value, the conversation still prompts for X as the minumum password length.
This problem is documented in Cisco bug ID CSCsb28324.
Even though conversation might prompt for value X, subscribers can enter another value (set on the SAWeb), and the Cisco Unity system takes it.
To resolve the issue, upgrade to Cisco Unity 4.0(5) ES31.
To obtain an appropriate ES, open a service request by referring to the TAC Service Request Tool.