Might be an interesting white-hat idea to have a service that gets into a social network and spiders out, collecting thousands of user names. Then attempt library login attempts. In the event they are successful, the service contacts the user and warns them that they have a weak password.

Unfortunately this is so similar to standard phishing attacks that I'm afraid the good would be offset by the bad of reinforcing user behaviors that its ok to click through on 3rd party notices like this.