Google have recently added a setting to prevent this.
This article is for Admins only to reset staff or students passwords in bulk
e.g. adding all of your year 7 students in to a new group
Reset a students password
The realsmart default is to allow any staff member to reset any students password