A where would never work on a hash
#creating past_passwords table and verifying
strange sluice
Also, Laravel has password resets built-in https://laravel.com/docs/10.x/passwords, so why would you reinvent the wheel there?
Well, I don't really know what the issue is, but just going to say this; This sounds incredibly insecure, people would change their passwords for security reasons, maybe their password got leaked. If you're going to save old passwords and allow them to reset or even login with their previous passwords, what's the point of changing a password?