How would it have been hard? Seems like a 10 minute fix at most to me to rehash the old password once the user was authenticated then put a flag whether they'v

How would it have been hard? Seems like a 10 minute fix at most to me to rehash the old password once the user was authenticated then put a flag whether they've been 'fixed' or not. After 3 months deactivate the old passwords and sent them an email reset. Although AM was in the business of essentially blackmailing their customers. So ease of getting back in was of higher priority apparently.