<i>They should be storing a salted hash, not the actual passwords, so the content of the password shouldn't matter.</i><p>No, they should be using bcrypt.  You didn't think you'd get away with this by posting after tptacek's bedtime, did you?