A password is supposed to be very hard to guess by others but not so hard for you to remember so it can be said to be PII! And no, it is not assumed that IT will crack your password. Because how do you know how far IT would go to crack your password and how do you know they are not looking at your data as well? Employee/company officers' email may contain data that could be highly sensitive and something IT should not be looking at.