Sooz's password thread led me to this article in Government Computer News.
QUOTE
Users will chose(sic) the path of least resistance, particularly if they have to remember a password, so they’ll usually choose the easier three categories: upper- and lowercase letters and throw in a number. Hence, a lot of “Password1” — which, the report points out, meets the same complexity requirements as “X$nc*(24,” or any other combination that makes use of all five categories.