It actually comes from rfc2849:

The LDAP Data Interchange Format (LDIF) - Technical Specification:

      4)  Any dn or rdn that contains characters other than those
          defined as "SAFE-UTF8-CHAR", or begins with a character other
          than those defined as "SAFE-INIT-UTF8-CHAR", above, MUST be
          base-64 encoded.  Other values MAY be base-64 encoded.  Any
          value that contains characters other than those defined as
          "SAFE-CHAR", or begins with a character other than those
          defined as "SAFE-INIT-CHAR", above, MUST be base-64 encoded.
          Other values MAY be base-64 encoded.

So since we have

{crypt}

the

{

triggers the base64 encoding if you slapcat the Directory data out into LDIF. it has nothing to do with whom or what added the {crypt} data to the directory in the first place.