When any user account status is expired, a new password is requested on the login screen. Approximately 3 minutes after the password change, the user account status is locked.
When I watch the sys.user $ LCOUNT value, after 3 minutes, it is as if a trial is being made with the old password in the background.
If you wish, I can publish it in a short video on the subject.
Thanks.