Because bureaucrats love to be bureaucratic. They think they are adding value by imposing all of these restrictions. In reality, not so much. It's not clear that there is any value to requiring people to change passwords or prevent reuse of old passwords on a routine basis. But what can you do?
These policies are often imposed by non-technical people, who are not used to thinking through a careful risk analysis in a logical, systematic way. If it feels right, then they go with it. And I can understand why imposing this kind of requirements feels like a good thing: it feels like you're "doing something". And surely doing something has to be better than nothing, right? Or so the thinking goes, anyway. (The thinking is probably wrong, but never mind that.)
Alternatively, sometimes there are external compliance requirements that may force system administrators to impose these kinds of requirements. Those compliance requirements may not actually be useful or sensible, but if they exist, there is no choice: you have to comply.
I'd like to point you to a fantastic research paper on this topic:
The paper examines 75 different web sites, ranging across a wide variety of audiences and security requirements: from online financial sites, government sites, educational sites, commerce and entertainment, and so on. It surveys their password requirements.
It has some surprising findings. For instance, the degree of security sensitivity, the value of the resources protected, and the number of users don't tend to correlate with the strictness of the site's password requirements. As the paper says, "Some of the largest, highest value and most attacked sites on the Internet such as Paypal, Amazon and Fidelity Investments allow relatively weak passwords." Even sites that have a lot to lose from security breaches often have weak security requirements.
Why is that? This might seem a bit of a puzzle.
The paper starts to provide some hints when it observes that government and educational sites tend to have strict password requirements, but sites that accept advertising or gain more revenue per user tend to have laxer security requirements.
The paper finally draws the following conclusion: for educational and government sites, their users have no choice. Their users cannot defect to a competitor site. Therefore, those kinds of sites can get away with unnecessarily strict password requirements; they have no incentive to improve usability. In contrast, the commercial sites where users have a choice have done their own risk tradeoff and decided that the usability loss of strict password requirements outweighs any modest security benefit from strict password requirements. Indeed, even those commercial sites that potentially have a lot to lose from security breaches -- e.g., online banking and financial sites -- often have relatively weak password requirements. If you assume those sites know what they're doing and have done the cost-benefit analysis, this suggests that the security benefits from strict password requirements are outweighed by the usability costs.
It's a great paper. You should read it.
By the way, I know the paper talks about strength requirements, as opposed to password-change policies or password-reuse policies, but the same conclusions apply equally (actually, with even more strength) to the latter. Password strength requirements quite plausibly do have some security benefit. In contrast, it's not clear whether there is any rational risk model that implies any benefit for policies that mandate password changes (and prevent reuse of old passwords). This suggests to me that strict password-change policies and password-reuse probably don't make sense.