I'm sorry, but when was the last time anyone heard of anyone guessing a password? Sure, it's a very easy password to brute force, but it doesn't matter that it's the number of the paper, because nobody would have thought to try it, along with the thousands of other things it could be, each spelt in a variety of ways.

It's much more probable that they brute-forced it in microseconds from the md5 hash, which is where the actual weakness is. I will go so far as to say that, had they used bcrypt, this would have not been broken, because people don't usually go around gathering personal data about you to try by hand (unless you have the CIA interested, that is, and then they can get in in easier ways).