I've had sites tell me when resetting a password that my new password is too similar to one of my old passwords (not even the previous one.) Far too many sites do something similar to substring searches.