#2007 study: "average user maintains #25 separate accounts but uses just 6.5 passwords to protect them"