OrdinaryJellyfish would it show something like a warning prompt that says they should probably change their password
What I would suggest:
If we don't enforce the no-password-reuse, then show a banner like for email validation or new terms of use in Flagrow Terms. Make it dismissable or not depending on how annoying insistent you want to be.
If we enforce the no reuse, then redirect to a separate screen like for 2FA on most websites and ask to set a new password. Or more simply, lock the user and show a modal upon login, just like the terms extension (lot of similarities I realize).
A flag could be set on the user record during login to indicate whether the last password used for login was vulnerable, then use that to alter the UI or lock the user.
Or more radical, reject login and send a password reset email automatically.
