Depends on what you consider often I guess. But it's way more than zero times. If they balanced the security level properly they should happen about equally often. Maybe other people have accounts stolen more often, I donno. How about they add a checkbox for "I'm an ID10T who can't use a strong unique password, please lock me out at the drop of a hat"? That way users could customize the threat model for their own needs.