To be fair, if they had a lot of bad logins lately, then testing everybody is a reasonable thing to do. Back when we did the big reset on org in 2011, we just blanked everybody's passwords out and forced them to go through the two step reset process. Not the best, but the most straightforward thing to do at the time. Didn't cause too much hassle, although I was dealing with the confused user emails for the next three years (not a joke).