If an OS effectively remembers the current password and also the previous password to force a true password reset, you will need to change the password twice to flush the old password hashes from the system.
This usually is mentioned when giving instructions to change the KRBGT account password on a Windows Domain with the added caveat that some time needs to be allowed between the password changes so each new password propagates to all the domain controllers before the next reset is done so you don't have interesting issues crop up.