Failed password change attempts using "MODIFY USER" by users are stored into the Querylog tables. it appears as potential security issue. Please let me know how to avoid passwords getting stored in logs.
Apart from "not logging any sql" I don't think you can do this. The password is 'just' part of the sql request - which gets logged.