UNIX for Beginners Questions & Answers

I have been searching the web for the answer to this question but without joy.
Hopefully, someone here can point me in the right direction...

We have a number of application OS accounts which require to be set with password non-expiry via the chage command, such as for example...

Code:

chage -M 0 -m 99999 -I -1 -E -1 <username>

However, the host OS VM (Exadata env) which runs on an Oracle Linux distribution was rebooted a few days ago. The below messaging was observed in the 'var/log/secure'

Code:

chage[12345]: changed password expiry for <username>
chage[67891]: changed password expiry for <other_username>
chage[01234]: changed password expiry for <some_other_user>

etc...

We uncovered this, too late, after the application account became locked due to password expiry.

I'm assuming that somewhere within the rc3 scripts, there is a something invoking this as part of init script startup but I have no idea what or why? I can't reboot again in order to script something to decipher the startup scripts and I can't seem to find any identifiable pointers as to specifically what would've been executing in or around the time.

Something has been invoked here and reset the chage properties for some accounts by resetting back to some defaults. We are using PAM for authentication.
Anyone have any idea what this might be or how to trace the origin?

Thanks
R