Right I just had a go at this, and might have replicated it, and some other stuff as well.
Started a server with pw, added 7 bots to hit maxclients. Joined from another PC, there was no pw needed, and name of bot changed to name of new player. Then tried reconnecting, but needed a pw this time and every time after. Tried with 2 bots, so maxclients wasn't reached, joined and could still enter without password, but only on first attempt. Server was running build 38. Also couldn't see the scoreboard from the player that didn't need to enter the password (happened with 2 and 7 bots). Also whilst running the password server, shep also managed to join without a pw, and also couldn't see the scoreboard.