En una instalación limpia, al instalar el panel el usuario imscp_user queda abierto sin contraseña
That is not really true. The password is set for the imscp_user SQL user but root user can connect to mysql without password. This issue has been adressed in our development branch and the fix will be available in version 1.6.0.
See the errata regarding this issue: https://github.com/i-MSCP/imsc…aster-sql-user-imscp_user
Note that i-MSCP 1.6.0 is still under development and not ready for use yet.