Comment by xlfe

Who knows? All I am doing is working from the data available.

I've tried to be clear about the methodology. My guess is that most users just reuse a small number of passwords. Anecdotal evidence supports this.

If you have a suggestion for how to derive a better _estimate_ from available data I'd be very interested to hear it.