If they've reset their password a bazillion times this will compute the passwords for all of them. Since you're ordering by time_set it would make more sense to only iterate over the first reuse_distance entries.