The (hashed) password of users with a "+" or "-" in their username is being sent in the periodic emails as-is instead of being replaced by "(password)".
If the intent was to ignore NIS entries, then it should check only the first character. But I think that this is unnecessary, NIS entries follow the same format and the second field either is a password or should be empty.