Basic analysis of the list […] throws up some interesting output:

- A little more than 2% of the full list is abuse directed at the site operator (more when duplicate records are removed), including some basic ASCII porn mixed in with the results.

- For too many users, if the login didn’t work the first time, nothing was going to stop them from try, try, trying again (I’d regard those records as excellent live data). Removing duplicate logins takes the list from 56k records to 41k.

- Even better, some of the repeated attempts are users correcting mistakes from the first time they tried to enter their details.

- It’s a family thing. It appears that some users (who only tried 5-6 times to login) convinced family members to try and login to the site themselves (or family were caught the same way).

- An obscure email address is not an effective means of hiding identity, especially if the user then spells out their full name in their password.

- While not the exclusive domain of Hotmail (15162/11360) / AOL (7137/5448) / MSN (1449/1069) / Gmail (825/620) / Yahoo (16562/12168) account holders, the list is heavily biased towards them (orig list/
duplicates removed).

- Approximately 25% of the results for each of the main email domains is the result of multiple attempted logins (surprisingly consistent across each domain).

- At least one request from a user to target a specific myspace account.

- Password strength is fairly weak for most users. A simple dictionary attack will capture most of the passwords available.
Repeated login attempts appear to be associated with weaker passwords. Variations to standard dictionary words seems to be restricted largely to adding a number before and / or after the word.

source: full disclosure