When a site gets hacked, or otherwise, the web site forces you to change your password. This is done by simply telling you to change your password, not enforcing it.
Why do they do that? For instance, they could:
- Disable your credentials, and send you an e-mail for password reset.
- In case you missed the email - or you aren't using the service very often and chose to ignore the password reset email - just keep the account deactivated until sign in is attempted, then send the password reset email, with hyperlinks to report possible unauthorized sign-in tries.