Usually you have to enter your old password on the same form in order to set a new one.

Alternatively they could run a bunch of common substitutions on the new password, hash, and check if anything matches the old hash.