We are currently having an issue with a comma being added to passwords created in order forms. The comma is clearly not present before the order form is submitted but definitely appears in the database and email sent to users. Here is the code used to generate the randomized password. I tested it 10,000+ times and never got a comma out of it.
Solved the issue. I had two hidden password fields which seemed to be causing the comma issue on submit. Removed one and the issue was resolved.
On interesting. Makes sense, now that you found the cause.