I am working on application where I want to add support for Event Sourcing and I am thinking how to solve problem of the passwords (unfortunately I cannot delegate authorisation to external service). The problem I have encountered is the question "how insecure is storing all passwords for given user (with metadata, like time of change), even in hashed form?".
I would just record an event like
on timestamp T user U changed the password. Storing anything related to the password makes little sense.
Saving the plaintext password is madness. Saving the same hash as the password storage is madness too. Storing a stronger hashed version of the password does not make sense, why store something stronger on the log? Storing an weaker version undermines security.
Saving just the relevant event data (timestamp, user, maybe application module, IP address, things like that) and leaving out the password is enough.