That’s easy to prevent: Disallow the use of breached passwords - whenever a password change occurs check against e.g haveibeenpwned. No need to remember past p

That’s easy to prevent: Disallow the use of breached passwords - whenever a password change occurs check against e.g haveibeenpwned. No need to remember past passwords (which is another security risk btw if you ever get breached it will leak all passwords the user ever had).