You are in fact pretty much stuck to storing that hash (or the plain
password).
The best recommendation I can make is to add the extra field, and
populate the secondary field whenever they login through the 'regular'
frontend. This is pretty much the only time you'll actually know what
the password originally was.
Evert