Lack of corporate policy
Same password used by multiple accounts
Storing passwords in clear text files or on paper.
Not changing passwords every month