I assume that what's going on is that there is some kind of cache between su and the directory service (or netinfo if su is going direct). Caching, say, a (name, uid) relation would be perfectly sensible, but passwords really ought to be excluded.