Yes they can. They can log into the webmail interface (www.yourdomain.com/webmail) and select Change Password from there.
