When wallet encryption was first introduced I created a bunch of fake encrypted wallets which purported to own various mixes of high value addresses and seeded edonkey and other similar file sharing tools with them.

Every once in a while I remember this and cackle with a bit of glee thinking about the pathetic would be thieves wasting their time grinding away at something which will never yield, and the real wallets they ignore in favor of the trap wallets.

I'm not sure why any fake wallet would have below minimum counts, I even think in some of mine I set extremely high counts at the upper limits of plausibility in order to maximize time wastage.  Perhaps there have been some versions which didn't impose a minimum limit subsequent to the original, perhaps knots or some other fork of the software that gets off on the practice of giving users configuration options that enable self-sabotage.

Setting kMasterKey.nDeriveIterations to at least 25,000 if it's lower—were introduced in Bitcoin version 0.4.0 to enforce a minimum security level in the wallet encryption process. This means any wallet.dat file created or rewritten with v0.4.0 or later will always have at least 25,000 key derivation iterations recorded inside. If the count is less, it's very likely either from an earlier version, is corrupted, or is not a legitimate file.