They could have changed the setting any time the user logged in. I pointed out that they used too few rounds over a decade ago, I believe. To their credit, they increased the limit to 256K in response (it was much lower before).