And I'm now 99% sure that the culprit of all this confusion is... plymouth! It has a password caching facility and systemd seems to use it to get the cached password.
-- Carles Pina i Estany Web: http://pinux.info || Blog: http://pintant.cat GPG Key 0x8CD5C157