In reply to Knut Sparhell.

WordPress didn't enforce strong passwords until 4.3 (recently released). It is easy to deduce that there are going to be weak passwords.