How password expiration email is triggered and what process checks the last set password and what triggers the email?

Check out this post I solved with a similar requirement to stop emails from being sent based on a specific user variable.

I don’t know if the password expiration email surfaces the right user attributes for lifecycle state, but it’s worth a try.