The AD account which was used to install FIM ("Administrator" in the FIM DB) always gets prompted to register for Self Service Password Reset, even when not in the Password Reset Users set. Is this expected behaviour?

No, that's definitely NOT expected look for all MPR which contains AuthN WF and ActionParameter=Modify and Attribute=PasswordReset for each of the MPR, check if administrator is in the ResourceSet also check if you are using any reflecsive rightsThe FIM Password Reset Blog http://blogs.technet.com/aho/

Figured this one out - User was in PW users set - hadn't realised that in RC1 of later this group has dynamic membership enabled by default.