Well, if he used the same strong password everywhere, it would still defeat any automated system. The reason you don't use the same password everywhere is in case someone decides to try it with your email address in a bunch of different places.

If I found his password for this site was hunter2HN, I'm pretty sure I could guess his Facebook password...