Even better is that some people just use the password as the password hint.
I only noticed one password hint that exactly matched the password -- I'd have thought that would be disallowed. Plenty of hints that were the password plus one character, reversed, etc.