Not that I support managed hosting companies. Nothing against WPEngine but I like to manage my own thing...couldn't you...

Install 2-factor authentication?

Simply reset all passwords and sending them an e-mail with their new passwords?

I am sure you can do in WordPress, click a reset button, and automatically triggering an e-mail to the client, that includes a link so clients can click and set their own password.

I know when I reset my Google password, I can't use a previously used password.