But how did they know which punctualion characters to remove from the password? You may try 2 versions of first letter, but do they go as far as bruteforce rem

But how did they know which punctualion characters to remove from the password? You may try 2 versions of first letter, but do they go as far as bruteforce removing all the % character combinations from the password, unless they did remove them all?