I can't think of any legitimate reason why one would need the user passwords to shift services providers. (My guess: they're planning on setting up the new AD service with the same passwords as the old one, but that is indeed just not done.)
If that was IT guys original idea, then it is time to find another one. However, if IT guys is also just another contractor, I wouldn't discount strongarming on part of the head of the firm.

And I agree with the others: it is CYA time.