Nipped that in the bud quite nicely. Some of those passwords were god-awful. Moral of the story: 2FA for the win.