And conversely, all 4 of the 14 char passwords were also variants of username/email address/domain.  Same with both 13 char passwords.

I'd wager most of the 2500 or so passwords cracked were variants of the email/username/domain.  I think there is a pretty important lesson there.