All they need to do is store the last modified date to provide this behaviour. If the behaviour is "show message about password change if user tries to log in

All they need to do is store the last modified date to provide this behaviour. If the behaviour is "show message about password change if user tries to log in with old password", then no, it's not enough.