[danneu]

At the same time, requiring better passwords is an anti-spam mechanism for the platform.

I once registered a Reddit account that had the same password as its username. After my first post, the account's password was changed and it started posting spam.

The only explanation I have is that someone was crawling the latest posts and trying to crack new accounts so that they have a legit first post and registration IP address to avoid auto-moderation.

Or, for example, a forum that drops all rate-limits once you are 1 year old with 1,000 posts. It now may be attractive to crack trusted accounts so that you can send mass PM spam. Or imagine if a moderator gets their password cracked.

So it's not necessarily just in the best interest of the platform, but also everyone that uses the platform. Though that's no excuse for particularly annoying password requirements.

[bo1024]

True, but this bar for password complexity is very low, unless the platform is allowing very high numbers of failed login attempts. The attacker can only try a tiny number of possible passwords (hopefully only thousands per day or less), which even very weak passwords can defeat.