I go back and forth on this, but ultimately, anyone using "password" or "123456" as their password should expect their account to get broken into at some point. Honestly, I've never met anyone that uses passwords that weak for anything they actually care about, even completely non-technical folks.