Mostly I don't change passwords, because changing passwords around here is a royal pain (plus it's a pain coming up with a good new password). I change passwords when they've been compromised, and when there's a strong likelyhood that they have been, but that's pretty rare. I'm careful about what systems I use to log in from and arrogant enough to believe that I'd know relatively soon if they get compromised.

(Without meaning to slam Windows particularly, part of the reason that I feel I can get away with this is that I don't use Windows desktops. I'm not sure what I'd do if I had to use one; maybe switch to using S/Key or some other sort of one-time passwords, and get a PDA or the like to run the actual S/Key stuff on.)