Reply to thread

Not really seeing the bug here.

The user is shown a message when the change is successful, at least in the current XF 2.2 version; you mention 2.1 I can't recall if this is a recent change we made.

Furthermore they are sent an email confirming their password has changed.

My advice? Don't force users to change their passwords, and even more so don't force stringent password policies on your users. Two-step verification is a much better way to ensure your user's accounts are secure.