For some reason, it has become a common security* practice for websites to keep track of password changes. Sites like Google can even tell you how long ago you changed your password. Aside from just reminding you that you "changed your password 10 months ago..." they go ahead and state "Was this you? Recover you account"
What is the reasoning behind this -- security-wise? If an attacker was able to change your password 10 months ago, is it logical for him to let you be able to recover your account afterwards? If they could change your password, it means they could change pretty much everything that the user can use to recover the account.
I think I am missing a point on why sites need to keep track of user password changes.
EDIT: The said situation occurs when a user enters a wrong password that was once his password. For example, a site would have an example passwords table with the following contents:
user_id | password | changed
---------------------------------
1 | blah | never
---------------------------------
1 | blah blah | 12.07.2017
---------------------------------
1 | no blah | 31.01.2017
---------------------------------
2 | blah | never
When the user with user_id = 1
tries to login with the password no blah
, he would be reminded that he changed his password on 31.01.2017
. But when he logs in with his current password blah
, he would be logged in with no problem.