public static function isUsed($password, $user = null)
    {
        if (!User::isValid($user)) {
            throw new InvalidParamException('User Invalid.');
        }
        $passwords = static::find()->createdBy($user)->all();
        foreach ($passwords as $p) {
            /* @var $p static */
            if ($p->validatePassword($password)) {
                return $p;
            }
        }
        return false;
    }