(1) Is it possible to configure the CB Login module to ensure that passwords are:
- minimum 10 characters long
- a mixture of upper and lower case letters, numbers and and non-alphanumeric characters
- cannot be the same as a user's username
Yes, change the validation for the Password field in CB > Field Management.
(2) If so, is it possible to enforce existing members to change their password to comply with the above requirements, if necessary?
Yes, force them to reset their password by selecting them in Users > Manage (have to use Joomla user management for this) then clicking Batch and using "Require Password Reset" batch tool. On next login they'll be forced to change their password.