Re: Stale old creds...
Forcing a user to reset the password is quite easy. Just force them to prove is them when they log in and then force them to register a new password.
Companies just don't like to do that because they hate admitting data leaks.