Spend x weeks updating passwords as the users log in, then for whoever hasn't logged in since then can be sent an email (maybe it doesn't have to exactly say "L

Spend x weeks updating passwords as the users log in, then for whoever hasn't logged in since then can be sent an email (maybe it doesn't have to exactly say "Login so I can update the passwords", just some sort of incentive to log in.