That said, I know of one event where someone got into a bunch of accounts on a site and did some real damage by using known username password combinations and p

That said, I know of one event where someone got into a bunch of accounts on a site and did some real damage by using known username password combinations and preemptively forcing specifically those accounts to change their passwords and blocking them from being used would have prevented the outcome that the site invalidated literally every user's password instead.