What good is requiring you to change your password on the next login? How do they know it's not just being re-compromised? There are a lot of accounts that are

What good is requiring you to change your password on the next login? How do they know it's not just being re-compromised? There are a lot of accounts that are orphaned, but the contents are exposed and still a threat to the original owners. Why not just lock the accounts?