When you force people to change their passwords, you ineptly are forcing a WEAKER Security because now they're forced to try and pick a password that's more predictable to brute force attacks when someone phishes for information.

When people are forced to pick a new password for something they aren't going to use a Password like "Xu10yPir73" Which looks like total nonsense. They're going to use one like "TacoRaider911" Which is something they know it's personal to them and even if someone guesses part of it they're not going to connect that They like Tacos the Raiders and Porsche 911's and would use that as their password. Now they're going to be forced to be like.. Raiders23 because that's the next year in progression so they'll be hopefully using that password for the next year or two then when your force them to change it they'll just up the number by 1.