Yes, this would suffice. But I think it points out that a duplicate password is just a proxy for a weak password: strong passwords tend to be locally unique.

Yes, this would suffice. But I think it points out that a duplicate password is just a proxy for a weak password: strong passwords tend to be locally unique. If you are going to have a strength requirement, then run your strength validation routine and deny weak passwords. That a password is duplicated seems like a special case of weakness that is not worth checking for. i.e. You probably don't want special checks for 'password' or '123456' either, since your strength validation routine should catch these.