So I stumbled upon this handy chart:
http://en.wikipedia.org/wiki/Comparison_of_Exchange_ActiveSync_Clients
Which cured my head-scratching over why I couldn’t see a recovery password for certain devices. Not all Active Sync clients support it. In fact, most don’t.
Could be useful to keep in mind when deciding company policy.