I recently had to change a password on a private forum -- but everybody who had accessed the forum previously still has access without using any password at all (new or old) until they manually log out and back in.