Alright, based on your comments, I ran down another rabbit trail.  I have a 3rd party administrative module that 'enhances' the functionality of the various user account security functions.  I tested the same scenario as listed previously and get the same results.  Apparently this 3rd party module plays along the same party lines as the core code.  Screens are virtually identical, and operates similarly.

But, the interesting tidbit I discovered during my testing, on my 4.9.x environment, if an admin account attempts to change their password, they have to enter the current password, the new password, and the new password as confirmation.  When they click to change button, the same error occurs BUT the password is actually changed to the new password. This occurs in the core code as well as my 3rd party security module.

I don't see this happening in a clean install of 5.00.01 (Didn't test in upgraded 5 environment- already deleted).

-Travis

I ended up building my own challenge/response system that parallels the built-in one..  Mine allows the custosmer to enter up to three challege questions and responses.  They will be presented with a random selection from their list of challenges and will have to supply their response.  I can also re-initialize the challenges and responses and force the user to enter new ones the next time they login.

-Travis