Three possibilities:
1). Microsoft was always truncating it and you just were not aware. Can you use the old system with a 16 character password and wrong characters at the end?
2). They were storing the passwords in plaintext (or equivalently encrypting them while giving them an option to decrypt them).
3). When you first migrated accounts (or secretly in anticipation of you eventually migrating), they required you to enter the full 18-character password, checked that you were who you said you were against that, and then created and stored a new 16-character hash of the truncated password.
Regardless, truncating passwords or forcing short password lengths (especially as it prevents passphrases; a moderately strong passphrase like correct horse battery staple is 28 characters long) is bad password policy on Microsoft's part. Password lengths should not be truncated until at least ~50 characters or so, somewhat dependent on the entropy of the hash; e.g., if you only check against a 128 bit hash it makes little sense to allow passwords longer than about ~80 characters).