Simply salting hashes would be enough to prevent password hash list lookups. Agreed, 2FA is pretty essential, though I can understand not implementing it where people don't care about the integrity of their pseudonyms. As it gains popularity, it will need to be implemented