We call this the plus one rule at work.

I kid you not, those of us subject to rolling our passwords do just that. Add one. One system had a restriction of not the same password within 32 changes so inventive users were simply do that in one try until changes got limited to once per 24 hours