At which point, they hit reset password (either on that page, or on successive logins) until they get four words that stick trivially... because they're a normal sentence.

Slow them down?

To bend a cliche, users interpret things in their way as damage and route around it.