Bitcoin Core wallet encryption works by encrypting the private keys stored in the wallet file. The private keys are encrypted with a master key which is entirely random. This master key is then encrypted with AES-256-CBC with a key derived from the passphrase that you enter using SHA-512 and OpenSSL's EVP_BytesToKey and a dynamic number of rounds determined by the speed of the machine which does the initial encryption.

Now, the first wallet file contains private keys that were encrypted using your original passphrase. So, if you had backed up that file before changing the passphrase, then your old passphrase will work in unlocking that wallet. Thus you can spend the funds held in your original wallet.dat file with the old password.

However, the look-ahead keypool is refreshed so that any new addresses you request after the password change are not in the old wallet with the old private keys. This means that if you don't spend your bitcoins after you change your password, anyone with a copy of the original wallet with the old password can still steal your Bitcoin if they have the old password.