we force random userid/passwords on our members (I have not had one person complain about this either) because most of the time when we found password leaks in the past it was because they always use the same simple u/p for every site they join.

check your logs, when hackers come to visit you will notice the same series of u/p that get tested over and over again.