Additionally, if I'm reading this properly, it only includes people who chose numeric passwords when they could have chosen anything (presumably beyond alphanumeric even). This means that all of the folks who chose a password outside of the PIN domain (presumably because they know better) don't have their PINs represented here, and I'd wager that a better proportion of those numbers are beyond 1234, 0000, etc..