The token is only validated for time series, not for reuse. Using the current password hash would invalidate the token after a password reset.