After changing the password via the Password Change, it still allows user to login SharePoint via both old and new password.
Solution:
There is a buffer after changing the password, usually Microsoft SharePoint will keep the old password for 1 hour by default, so during this period, both old and new password work. It happens for huge organization or internaltional companies sometimes.
Applies for: SharePoint 2013, SharePoint 2010, SharePoint 2007