TL;DR The security risk is only increased in the event of a database breach where the older passwords are stored on a Weaker Work Factor
One more thing, is straight theft of a password via a virus on the victim's computer. It could be helpful to know for sure that the password was once valid, and then to try some variations on this, but this would only have limited effect as this attack is probably going to then require Online Brute Force which will probably fail.
A site of this importance should already be using a Secure Password Hash such as BCrypt already w/ appropriate Salt & Pepper.
In this case, if the hashes are compromised, then the attacker would next have to Brute Force a multitude of possible passwords, so that the original password could be determined. This may take a long time if the password has a decent level of entropy. However, some users are lazy, and will use simple passwords. Those will be cracked first.
There are two types of brute force to consider.
Online Brute Force, which typically will not get you very far. The site's public servers should only allow you to try a limited number of passwords in a given time period before Captcha is presented, severely limiting the number of possible passwords that can be attempted.
There should be additional layers of security as well. For example, if enough Captcha-authorized attempts continue to fail, then they should lock down the account or block that IP.
So there's probably no additional security risk to this type of attack.
Offline Brute Force is when the database is comprimised and the hashes are stolen. In this case, not only do the latest hashes leak, but the older ones as well, because, as you say, those were not erased.
In this case, there is also no additional security risk because cracking the older hashes will serve no purpose.
An exception to this is if the Work Factor was adjusted. The older passwords may be stored on a weaker Work Factor, in which case the attacker would crack the older one first, and use that as a potential hint to crack the latest password.
Once an offline hash is brute-forced, that password would be used by an attacker to gain access to either the main site's account, or try other sites (i.e. Email or Online Banking) where the user may have re-used that same password. (so don't re-use passwords)