Issue with password change in Disabled Account

How it was found

Hello Hackerone,

Summary: I have found that #38343 is not yet fully fixed, disabled user is not always gets notification about password change when a password is changed via password reset link, then such a notification is not send to the disabled user.

Description (Include Impact): When a password changed in user's profile When a password changed in user's profile or password reset links for enabled/active user receives a notification via email containing that the password was recently changed. This is the fixed that reported in #38343.

However, it defeats the fix in #38343 because when a password changed in password reset links for disabled/inactive user does not receive notification via email containing that password was recently changed.

POC https://vimeo.com/214135835 password: protection