Scenario:

USER logs into the webmail and checks the "remember me" option when logging in.

ADMIN later changes the users's password

USER can still return to the webmail and is auto-logged in since the "remember me" cookie allows them access

Possible Solution:

Add a "last password changed date" to the authentication cookie.  When a session starts, if the user is already authenticated, then check that the value of the last password change for the user's account matches the last password change date set in the cookie.  If not, force a re-login on that device.  Then, when a user changes their own password, also update the cookie they are using on that device at the time with the new value so that they don't have to re-login on the device they just used to change their password (but they will have to re-login on other devices, which makes sense).