Only the no-longer-in-use passwords, which could be collected at the point in time when the user changes it to a new one.