See these lines in at_pwd_form.js. Here's what's going on:
After the user is created, submitCallback is called. submitCallback is the internal function that actually begins with calling the onSubmitHook provided by the developer, but submitCallback is called with undefined as the state – I believe this is because the function is called again further down with the correct state.
The problem is, in the special case of enforceEmailVerification, submitCallback isn't being called again. The form's result text is set to signUpVerifyEmail and the form is reset – but calling submitCallback again with the proper state is forgotten before returning.
I've created a patch that solves this and will send a pull request shortly.