Sorry - I missed* that you wrote passwd username - I was thinking too much of the init=/bin/bash part
I thought that did not mount the partitions so I checked and there was a mounted root partition alright
There are a bunch of "nasty" attacks you can do if you have physical access.
Google for change or delete password linux and you'll immediately find a bunch of solutions
One thing you might try is to delete the hidden files .ICEauthority and .Xauthority in home
They are recreated automatically if deleted
* Seems I answer to may posts - has to be quick