When that happens I usually just exit the password reset page without entering a new one and then log in again with the old

They invalidate it because they got hacked or they fucked up some other way but they don’t want to admit it, so they don’t tell you about it and they act like the user is wrong.