People come back to things they know, so if you force the employees to change passwords periodically, most likely, they will start to generate patterns and/or rotate their passwords.
A plausible attack may start by using social engineering to impersonate both end-users and help-desk personnel to obtain information regarding procedures, recommendations, ...
The reason why recommendations for years is to stop passwords from expiring is to prevent people from doing what they normally do: mypasswordJune.
If you know that a large section of the user population is changing their password on June 1, then you can start creating password databases based on common patterns and adding:
So the big ...