Why do you need to send a password when using their Autodiscover API? Would Outlook send the respective passwords for each email account to Microsoft?

I suspect they try to login and reverse engineer the IMAP config.

curl -u just requires the field to be there, I suspect. No authentication takes place. You can send any password and the output doesn't change.