This sounds like your phone had a different home before you bought it.
Here are my thoughts on the matter and I may be 100% wrong.
Polycom has a feature/web service called ZTP. (Zero Touch Provisioning) / Redirection Server
Your IP650 MAY be using it.
When you power up the phone, it goes to a Polycom ZTP Hard Coded URL to see if it should go to a Configuration Server somewhere else.
If it does, then that Configuration Server, which the phone was Redirected to, is changing the Password.
You can use Wireshark to see if the phone is going to one location and then goes to another location for a configuration file.
If you get the IP Address of the ZTP Server, you can try to block access to it in your router.
There is a Catch-22 here.
You can disable the ZTP Feature in the phone, but you need the password to get to it.....
You could call Polycom and find out which dealer sold the phone.
Then call the dealer to find out who they sold it to.
Then call that final company and ask them to remove your phone from the Polycom ZTP Server.
I would not count on too much cooperation though...