I have seen a couple of posts on this, but I haven't seen a definitive answer necessarily. Therefore, I thought I would try to restate the question in a new context (Department of Defense).
According to DISA's "Application Security and Development STIG, V3R2", section 3.1.24.2 Password Complexity and Maintenance, DoD enterprise software has a pretty tough guideline with passwords:
Passwords must be at least 15 characters long.
Passwords must contain a mix of upper case letters, lower case letters, numbers, and special characters.
When a password is changed, users must not be able to use personal information such as names, telephone numbers, account names, or dictionary words.
Passwords must expire after 60 days.
Users must not be able to reuse any of their previous 10 passwords.
Ensure that the application has the capability to require that new account passwords differ from the previous password by at least four characters when a password is changed.
Users must not be able to change passwords more than once a day, except in the case of an administrator or a privileged user. Privileged users may be required to reset a user’s forgotten passwords and the ability to change passwords more than once per day.
As stated in NullUserException's post, for the developer to actually be able to check for the last X amount of passwords (and also ensure that new passwords differ from the previous password [bullet 6]), the passwords would have to be encrypted using a reversible method, rather than hashing a password (which is a lot more unsecure, even if I am using NSA approved encryption