MessageLabs said there was evidence of an increase in the number of brute-force password breaking attempts, where dictionary attacks are used against online webmail accounts, perhaps using POP3 or webmail to conduct the attacks. “Users with simple or weak passwords are the most vulnerable. On the website, an attacker will be asked to solve a Captcha puzzle to prove they are a real person. Captchas can be easily bypassed using a variety of Captcha-breaking tools,” MessageLabs said.

You might try memorizing a long poem or something like that and then cycle through uses of the first letter of however many words are needed to hit the right password strength, next pass use the first and third letter, etc. It makes it easier to remember the new password each time because you remember the previous password from having used it for 3 months and you know the algorithm for choosing each 'next' password ...