[dredmorbius]

Case-sensitivity is an interesting observation. It makes it 1) more likely that the passwords are being stored and that 2) there are multiple interfaces used: the Web front-end which can handle capitalization (something which can be unambiguously transformed) and a back-end SABRE system which likely cannot but a case-shifted password could still be passed to it.

As for your voicemail system, that merely gets around the issue of competing standards by enforcing its own. And the mapping has to be repeated to every user for every use of the system. I'd actually consider it an argument in favor of the keypad theory.

Escape codes (or testing codes) is another possible explanation. And legacy code cost is indeed often a consideration.