Password value binding triggers updateTarget?

I am observing a strange beahvior that is causing me trouble.

I have a simple value binding + behavior on a password field:
``.

When I type text in the input, I see `updateSource` is called, as expect.
When I mash keys -- or simply press two keys at the same time -- it seems `updateTarget` is called as well. But why? This is causing unwanted side-effects in my binding behavior.

This is easy to reproduce in IE11 with a password box: just hit two keys at the same time.
It seems it sometimes happens with a normal textbox as well, but it is a lot harder to reproduce.

Start by reproducing the value binding and behavior from the issue in IE11, first with a password input and then with a normal textbox. Trace the updateSource and updateTarget calls while pressing keys simultaneously; done means explaining the extra updateTarget call and determining how the binding behavior should avoid the unwanted side effects.

Written by the indexing model from the issue text.