The password may have been recorded by someone examining packets being transmitted over the internet. The account owner may have told someone else what the password is. Revalidation prevents an intruder from gaining access, even if he guesses the password, since the owner must supply identification information unique to the owner before access is permitted. The last step in the revalidation process requires the owner to type the old password. If the new password passes the cracking tests, it becomes the password in effect for the account.
Online help is available for new password selection.
While an account is in revalidation state, various services that the account owner may expect to work, stop working. Telnet, rlogin, slogin - login is not permitted, except to revalidate. Ftp, uvarsh - login is permitted, but without the expected home directory. Rsh, ssh, calendar - does not work. Most jobs require files from the home directory, so they will probably fail.