[StavrosK]

You have to have stored the last password change date, which many systems don't do.

[jtheory]

If they didn't before, they can start storing it to implement this.