You should never keep plain text passwords. bcrypt it at the very least. I'm referring to keeping a history of those hashes around to compare against other leak

You should never keep plain text passwords. bcrypt it at the very least. I'm referring to keeping a history of those hashes around to compare against other leaked databases one would find on the dark web. Having a history of the last password hashes are n+1 as bad as storing a password hash.