This should be coupled with the usage of multi-factor authentication and making users aware of when and where their accounts have been used. In organizations,

This should be coupled with the usage of multi-factor authentication and making users aware of when and where their accounts have been used. In organizations, one issue is users knowingly sharing their accounts with fellow workers. It's not because they don't know better, but because this is more convenient. Forced password changes (with limits on password re-use) can limit the risks caused by this.