Account password rotation is often a regulatory requirement. For that very reason, MySQL allows you to have multiple passwords on a single account.
I have written about this in Rotating Accounts or Passwords?
.
Of course, if something is a regulatory requirement, you also need to prove that you are meeting it.
So Percona has a nice article Tracking Dual Passwords in MySQL
which shows how can (not) track dual password usage.
While it is somewhat possible to generate a report that shows you which accounts have dual passwords, other things are hard. Finding out which accounts have used what password last, or if an old account password is still being used (and from what machine) is either painful or …
[Read more]