Don't you need at least one other piece of identifying info to make that useful? Like, I could churn out mostly valid gmail passwords all day, but I have no idea which users have those passwords.