Actually because when you md5 a password it calculates a hash. Then the string is longer than 16 characters some "hashes" can collide between them.
For example if
9ce405c98406f2f6d5326ee6b51d19cd it is possible that
md5("ididntfixedmyroofwhenicould") could give the same hash
9ce405c98406f2f6d5326ee6b51d19cd. Remember that hashes are composed by with 32 characters of "0123456789abcdf" (for md5 in this case).
Maybe they force 16 character because the algorithm that computes the hash assures that will not have a collision in the database with a previously saved password.