1. It happens more than you'd think. Some legacy system is still up and they are connected to the same credential store. You find a hole and get into their internal network and some random webportal that no one maintains still has access to the database.

2. Yes, so this one is more like you are shooting with a shotgun from a long long range and hoping to hit. You can improve the accuracy by using a password dump on your target. People have a common pattern that they use with their passwords. You can either find one that is still being used or try to find a couple they have used and create a new one. Great site to demonstrate the power of a password dump is https://haveibeenpwned.com/. So in some cases it is possible, but as someone who professionally red teams, I wouldn't bruteforce past a certain time period before trying something else.