Or the password is used in sprintf() ... I know at least one organization where this happened. The % was being stripped from passwords for that reason.

Or some weird non uniform URI encoding, as % is used to start the being of a hexcode for characters in URLs. Such as %20 being a space.