Originally Posted by TomL.
hlds doesn't automatically executed the server.cfg after changing map.
That's mostly true. However, the file configured with the mapchangecfgfile cvar will be executed at the beginning of every map and this is most often set to server.cfg.
@El Abuelo Loco, find where it is being set in your config files. You might also check amxx.cfg and any other cfg files in the entirety of the mod directory. If it's not in one of those then you probably have a rogue plugin that is maliciously changing/setting sv_password.