After introduction of RA Key recovery, enrollment using request Id can be done with any password after a key recovery (with a password already set during key recovery process).
This only occurs if 'reuse certificate' is enabled for key recovery.
Root cause:
KeyStoreCreateSessionBean:

if ((reusecertificate) && (keyData != null)) {
   no authorization is performed...
}