I have noticed that some sites would not let you login with the old password if a new password is requested, but was not changed.
Example: I forgot my password and requested a new one in the email. Received the email to reset it, clicked on it and then while typing, I remembered the old password. So I cancel the page and go back to the login page. However, it would not let me login with the old password as I have requested a password change.
What compromises are made possible if we let the users login with the old password, instead of making them change the password?