Comment by ur-whale

Any reason why a dictionary based attack wasn't tried first?

Or did your client remember selecting something really hard in the first place?