SCCM Client Push Account

We have the SCCM server setup within a client environment. the SCCM Client Push account is locking out on client machines because of a bad password. It is my understanding that this service account is is used for Pushing the client out to computers.

We are having alerts from internal and remote users (over the VPN) where this account is trying to access something, Is it correct that this account should be calling back to the central server? and if this is to connect back into the network how can this be managed with the password reset schedule for service accounts....?

Thanks in Advance