I wrote pam_pwnd to deny the use of passwords which have appeared in the have I been pwned database(s):

https://github.com/skx/pam_pwnd/

That's not exactly the same thing as denying a previously-valid password, but it is along similar lines.