If one can buy 1000 ID's for $25-$45, actual password strength is probably much less important than using different passwords for different sites. Why bother running a password library or brute force program when you can just purchase the ids/passwords for so cheap?