I don't know the origin story but (U.S.) National Institute of Standards and Technology (NIST) recommending password expirations from 2003 until 2016 played a p

I don't know the origin story but (U.S.) National Institute of Standards and Technology (NIST) recommending password expirations from 2003 until 2016 played a part in propagating them. But I think that recommendation was largely based on was already fairly common, I think Microsoft Windows and Active Directory accounts expired by default well before 2003 (at least Windows NT and its successors).