Exactly this. All previously stored data is compromised. Obviously, people can't change their birthdates, but the password reset function unquestionably has to

Exactly this. All previously stored data is compromised. Obviously, people can't change their birthdates, but the password reset function unquestionably has to rely only on newly-supplied, uncompromised data.