ACP > Users > Batch update the inactive users or usergroup to force a reset password. The next time they log in they will have to reset their password via email received so unless they also hacked the users email account they will not be able to.
If they did also hack the email account changing password via SQL query would be no use either anyway.