Comment by thrwyoilarticle

>Furthermore, you must retain old passwords to disallow dupes for at least 5 cycles.

More cynically: password reuse is allowed after 5 cycles.