I was seeing this behavior with password changes and went through all the Moodle LDAP settings trying to stop the old passwords from still working, but nothing I did seemed to make a difference. We have 1.9 and 2.3 running on completely different OS versions, so once I saw the same behaviour on both, I started to think it was the LDAP/DC server side that was the issue, since they both point at the same Windows 2003 servers for LDAP.
After some research on the Windows Servers side, I found some references to this Microsoft kb article:
http://support.microsoft.com/kb/906305/en-us
And just like it describes, after one hour the old password stopped working. So you'll have to change this registry value to reduce the old password lifetime, or live with them working for an hour after the change.