Quick question!
Please can you check the source of the users in AAD portal, are they Active Directory or Azure Active directory users ?
If you see source as active directory user, that means they are sync from om-prem and they shouldn't have different password.
If the source shows as azure active directory they might have different password.
Syncing with Azure AD Connect will create duplicate users if the sync domain extension is not verified in Azure, meaning that you sync example.local and or example.com
Please let me know if you have additional question.