You've still got to do it right. If I phish your twitter account and discover your password is "twitter-iloveyoujane", you can bet I'm going to see if "facebook-iloveyoujane" will get me into your facebook account...

And I'd be astounded if there weren't already automated tools that do this for every website in the alexa top 1000...