If the method is called `validate_password_reuse`, I would expect that it would throw an exception if the password does not adhere to the reuse policy. Since this function is returning `True` or `False`, I think `is_password_reused` would be a better name, and it would be better as a method on a user instance than a classmethod on a `PasswordHistory` model.