If using Exchange 2007 a user can reset the password using the OWA/web interface. It's a bit tricky because it's a generated string of numbers to confirm the "recover password" option available on the Windows Mobile's password screen in the "menu" menu.
With an older version of Exchange this is sadly not supported but you can do a factory reset / remote wipe of the device and configure it again. As all data should be in Exchange (contacts, calendar and so on), this shouldn't be a problem in a controlled environment - it's just like re-imaging a computer.
Mobile device support difference between Exchange 2003 and 2007
If you're using System Center Mobile Device Manager there's an addon that will enable a user to reset their windows mobile 6.1+ device passwords.