Exchange 2013/2016 OWA allows users to change their passwords, and additionally, helps administrators to force users to change their passwords.
After first login, and when the user tries to use UPN on password change page, OWA will return an error saying username/password combination is not correct. Which is not true, but OWA tells the user to use the format domain\username not the UPN.
This is because the home directory (OWA Virtual Directory) is configured to use that format for authentication. Although it’s ok to use UPN to login, for some reason the DLL file responsible for the password change is not able to tolerate that format.
Changing OWA virtual directory authentication settings to use UPN format will solve this issue for your users.
HTH,