Yes... there are lists that are generally used for common variants of passphrases and can generally crack a simple passphrase like ggp in less than a day easily, faster or slower depending on hardware in use, concurrency and order.

4-5 dictionary words with proper sentence structure is a lot safer for the most part. Random safer still, but much harder to remember... my current password for work in a sentence with 24 characters. spaces, capitals and punctuation. Other than my OS and password manager, I really don't remember any other passwords I use, and the majority are random generated at this point.

I also use a wildcard mail forwarder, so most new sites I've used in the past year or two are all unique emails as well.

Yes, definitely. The salt just means you have to compute a few hashes yourself rather than relying on a lookup table.