We aren't talking about just an offline password

"Even after users change their account password, however, it remains valid for RDP logins indefinitely. In some cases, Wade reported, multiple older passwords will work while newer ones won’t."

Even if Windows knows the password is revoked and knows the new password, you can still connect with the old per RDP.