I only noticed one password hint that exactly matched the password -- I'd have thought that would be disallowed. Plenty of hints that were the password plus one character, reversed, etc.