Through some trial and error I found that if the RDP connection is configured with the FQDN of the Active Directory domain, it will be automatically entered in the password change dialog. The DNS also needs to be configured for a domain server.
I did not add the thinclient to the domain.
The only minor issue is that the IP address of the domain controller appears in the password change dialog box, but we can live with that as long as the user dosen't have to type it in.
** Edit **
Unfortunately this did not work, received an error NT_STATUS_LOGON_FAILURE, which I assume means the computer must be joined to the domain.