I'm sure it's service dependent, with some services the frequency would likely be essentially 0, but some services like popular online games you'd see it happen

I'm sure it's service dependent, with some services the frequency would likely be essentially 0, but some services like popular online games you'd see it happen widely the first day you allowed it. The problem is, one person does this you pretty much have to change your code immediately if you disable an old password. And while I focused on the malicious, don't discount the accidental - my gmail routinely gets sent email meant for people who couldn't enter their own email address correctly when signing up for various things. If out of the blue a customer can't use their password and has to go find a new one to enter they aren't going to be too impressed even if it doesn't happen again.