Some underlying functionality borrowed from http://wordpress.org/extend/plugins/auto-expire-passwords/ , and tweaked. Untested, but along the lines of what you are looking for, so YMMV.
function custom_forced_password_reset( $user ) {
update_user_meta( $user->ID, 'password_was_force_reset', true );
}
add_action( 'password_reset', 'custom_forced_password_reset' );
// Ensure all new register users have the flag set
function custom_forced_password_user_register($user_id){
update_user_meta( $user_id, 'password_was_force_reset', true );
}
add_action( 'user_register', 'custom_forced_password_user_register', 10, 1 );
function custom_log_in_check( $user, $username, $password ) {
if ( is_wp_error( $user ) )
return $user;
// Check we're dealing with a WP_User object
if ( ! is_a( $user, 'WP_User' ) )
return $user;
// This is a log in which would normally be succesful
$user_id = $user->data->ID;
$reset = get_user_meta( $user_id, 'password_was_force_reset', false );
if ( empty( $reset ) || $reset == false ) {
$user = new WP_Error( 'authentication_failed', sprintf('<strong>ERROR</strong>: You must <a href="https://wordpress.stackexchange.com/questions/50093/%s">reset your password</a>.', site_url( 'wp-login.php?action=lostpassword', 'login' ) ) );
}
return $user;
}
add_filter( 'authenticate', 'custom_log_in_check', 30, 3 );