This is a good moment to say that hackers can crack 8 character passwords pretty easily with a fairly recent laptop. Complexity doesn't matter. It's the quantity. I'd make them 10 or more letters/symbols to be safe. Like someone else mentioned, it's likely the free email that's the culprit because of their liberal throttling measures.
