I would make a password change mandatory, create an alert reminding people to do it on the front page. The site can end up liable. Cuz I changed my password the last time it was brought up, and I STILL got it.