@ThreeUK why don't you allow customers to past passwords into your web forms, particularly the change password form? This make it much more difficult for people to use complex passwords

Your minimum 7 character count isn't good enough either