One thing I find fascinating is people's occasional ingenuity in getting around password strength requirements. For example, faced with the requirement that the password can't be the same as their name or username, sometimes they'll figure out what is the smallest change that will make it acceptable (like e.g. leaving out the last letter), and use that.

(Come to think of it, the very fact that I know all this also says something by itself.)