The issue, as I have found it started with the Web Client and I am a little surprised it is still an issue in vSphere 5.1 Update 1 as it is such an annoying issue. The problem as I see it is in the process of creating a Customization Specification using the Web Client and storing the Administrator password and the the account to attach the system to the domain.
I have found that if you create a NEW customization specification using the Windows client, you can then deploy a template using the customization specification from either the Windows client or Web Client without any issues. You cannot "fix" a specification by editing it in the Windows client and re-entering the passwords. My guess is there is a bug in the encryption process when saving the specification or the decryption process when using the web client for the passwords.
I have never opened a direct call with VMware on the issue as I have found this work around. I planned on mentioning it to the support folks at VMWorld this fall when I am out there.