Perhaps one mitigating fix may be to add some code that checks password complexity and if the check fails the admin must either remediate the bad password, or be forced to add a configuration directive that says "I_KNOW_I_AM_DOING_SOMETHING_SILLY_AND_RECKLESS=true".
Is something like this possible in PHP?