[euccastro]

If they did that, his old password would still work. His use of "no longer" implies that the password used to work before the policy change.

Unless at some point they started rejecting long passwords just for being long, without checking them against the database. And this is just not plausible.