I don't like the idea of a prompt to change your password when you have a new IP address logging into your account. These pop-ups could be annoying for
people that log in from different locations regularly (Sparky <3). What could be good though is if when you logged in from a different IP then your last is if a
security question popped up that you as the user would have set before hand. This way even if a hacker gets your password and logs in if he doesn't know your
security question then he can't access your account. In the case of the hacker logging into your account via In-Game client then when he hits "log in" a new
tab/window would open from his browser prompting the security question.

Also to make sure that the security question is actually impossible to guess I would recommend making both the answer and question completely custom by
having the user type it their self. Questions with drop down menus just aren't secure enough these days.