I have a partial solution to your original question. From one I get, your intention is to check if a given number of people are using the same passwords.
The answers here so far seem to go more in the direction of secure passwords, which is good.
While you should ensure 'strong' passwords, I think you just don't want a certain number of people to use the same password, however secure it is reckoned to be.
What if you do this? Keep a list of simple non-salted hashes of user passwords on point of registration. Like a SHA-512 hash. (you could even do repeated hashes a certain number of times only you knows) The list has no usernames, just password hashes that can be anybody's. You could even go further and implement it in a table, such that this pre-acceptance hash has a counter alongside, showing the number of people using a particular password on your site. Note that there is no way to tell the original password.
Of course, when you are actually storing the username/password in the database, you will then salt and hash. The aforementioned list is just a random list of pre-salted hashes of passwords together with the number of times that hash has been generated.
Now when a new user chooses a password, you do the pre-acceptance hashing and check whether that hash is already in the list and if so, how many times has the hash been used? If it's been used up to the maximum number of times you have decided, simply reject the password. On entry of a 'successful' password, enter the new pre-salted hash into the list.
Ideally, if users are using 'strong' passwords following the criteria other people have mentioned, the counter of each hash in the list should be exactly 1.
The solution is secure, as even if an attacker steals the list he can't use the hash to login, as its not the same as the actual salted hash in the database. Also you can use different hashing algorithms to frustrate cracking. This, of course, doesn't mean the attacker cannot try the usual means others have mentioned. What I am saying is that this solution does not in any way {further} compromise your users' security.
The downside (and why I said it's a partial solution) is that if the same user changes his/her password 3 times a day, the list is amended with the pre-salted hash of each of those passwords, even though in reality, no one is using any of them. And there is no way to check who supplied what hash as the list, for obvious reasons, does not contain usernames. It is very anonymous, and should be!
There is actually a fix to the downside, but I think it's better left unmentioned.
Let me know what you think! Thanks and God bless you.