Inspired by a (now deleted) post, I searched the Podesta files for "password" - and found John was very, very sloppy with his passwords. He not only used real words, but he also did not store them safely somewhere, so he repeatedly asked his staff what a special password of his was.

We all know he has changed his email, but his user names and passwords might still be valid for certain sites! It might be worthwile to check them all out because he has probably registered with many websites and may not remember all of them. Here is one example (login data not valid anymore, though): https://wikileaks.org/podesta-emails/emailid/39949

It may also be valid to search HRC emails for "password".