The tools are programmed to try the things that experience has shown people pick for their passwords. Computers don't get tired of trying. If someone has our encrypted password in hand, or if they can continually try logging in to our system without locking the account, they can sleep while their computer continues to chug along making guess after guess. People make mistakes. They sometimes type their password on the wrong computer, the wrong screen, or the wrong program.
Administrators make mistakes.
Security folks make mistakes. Everybody makes mistakes. All it takes is once. Example 1 . Example 2 .