bcrypt stores the salt and retrieves it for comparison - otherwise you wouldn't be able to generate a matching hash.
Consider the case where a user has a very long username and sets their password to their userId + username + password thus recreating the scenario which lead to the incident.
There's no hash collision here, just two different hashes, each with its own salt, matching the same original phrase.
If you use only the password to generate the cache key, then this password will match regardless of salt, so users with the same password will generate a cache key matching that password.
I'm getting the feeling that there's some kind of miscommunication here.
If only the password is used to generate the hash then that password, when used to match against a previously stored hash(cache key here), will also match it, thus producing the exact same vulnerability, but worse because it's enough to have the same password as someone else.
[1]: https://en.wikipedia.org/wiki/Bcrypt#Description