I think you’ve already spent more time on this than the users who needed to reset their passwords.
That’s usually a good yardstick on whether something needs building too.