Expiry - and back to old

In a previous long mission at a customer's, we were forced to change passwords every 90 days. Needless to say that after a year you stop being creative. One day a guy in the next office was logging in an pronouncing his password while typing it, such as "May2010". I laughed and asked "ah, you're using May2010 as well?", and he replied "obviously, everyone is using the same trick as there's no way to remember so many different passwords; there are variations, most use the date of latest change, others use the date of next replacement". I was already convinced that password expiry prevented one from building up and remembering strong passwords, now I had a solid proof of it if a whole company uses only a few bits of entropy between all passwords... The easiest way to log into a system without being authorized was to first choose as a password the month+year then randomly try many different logins until one validates. It's great that this bad practice is finally disappearing, after having been forced onto everyone as something absolutely and evidently critical to the global security...

One thing though, companies (and sites) who dropped that bad practice should have clearly told their users and forced them to change the password for a robust, definitive one, because I'm pretty sure that many people having experienced this bad practice are now keeping their last weak password.