It's a halfhearted attempt to protect against vulnerable zombie accounts. When someone leaves for whatever reason, their account (if not terminated) still has

It's a halfhearted attempt to protect against vulnerable zombie accounts. When someone leaves for whatever reason, their account (if not terminated) still has access. Someone could hack in (or the former user could try to log in at a later date) and get that access. The policy of "If you don't change your password in the next 7 days, you will have to contact IT to reset it.", (along with actually locking out the account if the password isn't changed in time), could greatly reduce potential abuse of those zombie accounts. A large organization, especially one with lots of turnover, could accumulate thousands of those zombie accounts over the years. Of course, the proper thing to do would be to deactivate the account when someone leaves the organization. But if the organization doesn't have it together enough to deactivate and reactivate accounts properly, they might rely on the time limit as a fallback. The reason your password isn't good now is that someone doesn't have the info they need to do their job (deactivating accounts) properly, is lazy, or is paranoid. In any case, it's a signal that the organization that's requiring you to change your password can't manage account deactivation.