I recently had to change a password on a private forum -- but everybody who had accessed the forum previously still has access without using any password at all (new or old) until they manually log out and back in.

That's... odd.

Private forum access rights are based on an additional cookie that contains the password. This password is checked against the current forum password on each request.

Are you sure that these were passworded users, as opposed to having explicit permission to the forum?

Nobody was directly accessed to the forum, everyone was required to use a password.

I tested it myself, logging onto my non-admin board account. Once I had typed the password I could access the forum repeatedly until I actually manually logged my account out. I had to test it using the new password though, since I had never accessed the forum with the old password.

The person making the complaint to me was a moderator to the forum; would he be able to access the forum while still logged in on the old password? Possibly he exaggerated the situation to me when describing it, and it was only him who could still access without updating the password...

Moderators don't need the password - they get allowed into their own forums by default.