like Peter, I have only seen it for the signup process on Yahoo.

Unless it is an antispam measure and they suspect your boss of being a spammer and it is a test to see if he is using a web robot to send mail.

One thing that I did notice, is that Yahoo broke the YahooPops application that did POP3/SMTP access for Yahoo accounts by pretending to be a web browser and sends the info back via the POP3 and takes info back via the SMTP protocols. Yahoo wants Yahoo users to pay for POP3/SMTP access. Maybe that box is one way that they check for that on certain accounts? Does he use YahooPops? Maybe it triggered the box?

Also it could be some spyware/adware program modifying web pages, hoping that someone enters a password into one of the boxes by mistake? If that is the case, they may even have a keyboard logger and your boss is already had since it got installed.

A quick test is to have him log into Yahoo on a different machine and see if it still happens. If so, then it is some thing Yahoo is doing. If not, then scan his machine for spyware/adware.