only thing we can do is try to crack the hash. This is where 3.5.7 kicks in “Enforce a minimum password complexity and change of characters when new passwords are
created”