Is this actually a password or something closer to a PIN? I don't know that there's anything wrong with not cryptographically mangling a PIN since there are so few combinations in the first place. I think the SOP in most cases (my bank, for one) is to use multiple forms of ID verification (last 4 of social, birthday, and PIN, e.g.).

Whoever runs their twitter also later claims that this account password is different than their online password, which seems to support that it's more of a PIN than global password. I'm not a Virgin employee or customer though, so I'm not sure if this is the case or not.