Yes, it's a little awkward. This apparent obfuscation is necessary because the Password property of WPF PasswordBox control is not a dependency property so cannot be bound to the view model by Caliburn.
To work around this limitation the Caliburn Message.Attach() feature is used to call the PasswordChanged method on the view model when the change event is fired. The password control is passed to the PasswordChanged method on the view model using
the $source variable. Because the method is passed a reference to the password control, it is able to read the password directly and assign it to the Password property of the view model. It also means that one PasswordChanged method can handle
multiple passwords by assigning the control's password based on the control instance passed to the method.
Just like a normally bound view model property and control, the act of assigning the password value causes the validation mechanism to be initiated.
Put a break point the PasswordChanged method then change the password and you'll see what's going on.