Or c-level executives will remember this tidbit before they let their security folks talk them into a password reset after a breach. You have to wonder whether a company in that situation has other options, like blocking logins from previously unseen IPs (for users who don't change passwords).