Next time you see the security guy, casually work into the conversation that since the passwords have so many requirements these days, you keep them all underneath your keyboard in case you forget them.

Then step back and watch his head explode...it's cheap entertainment.

Was I supposed to be one of the three angry people?  I absolutely agree that my role as an IT support person is exactly as you stated it - to support the user in performing their own job functions.  Sometimes the user needs more support than they realize, because really "fluffy" is not a good password to protect sensitive data.  So far, I have not found that a good correlation exists between someone being good at a job that may involve sensitive data, and being good at data stewardship. 
Regarding your email system - this is a matter dear to my heart (how sad is that).  Assuming that the guy has the type of resources available to him that he should, he should never be trying anything for the first time on live data.  Trying something new on live data, especially the company's email is a surefire way to lose your job in a hurry.  If he had the resources to test this ahead of time, and simply did not bother to do so, then I wouldn't get too used to seeing him around the water cooler.  On the other hand, if he is not given such resources, and simply told by management "We want this Exchange thingy," then (repeated) failure is inevitable.  For whatever reason, pushy managers who don't provide sufficient resources always seem to want the most expensive, least stable product in a particular niche (*cough* Exchange! *cough*) 
I am lucky enough to work at a place where we have test servers, and are given the freedom to plan our own upgrade path.  We test the heck out of anything before we deploy it.  About a year ago, we "changed around our whole email system" and only had a handful of grumblers (Most of these same people also complained when we gave them new computers, so you really just can't please some people!).  In short order, many started depending on the more advanced features of the new email system, and we are now on the verge of outgrowing that, so we're back to testing an even more robust, feature-rich solution.  It may seem like we keep changing things on a whim, but the idea is that since we support our users, ideally we listen to them when they say they need certain features, and changes are driven by that.
The dilbert strip is classic.  Our security group jokes about that sort of thing.  Anyone who knows much about security (not just digital) will tell you that if you make a security system cumbersome, then the user will switch it off, bypass it, or in some other way negate it in such a manner that the thing being protected is even less secure than if a more rudimentary security mechanism were used.  At work today someone sent around a realated dilbert strip, where Mordac used the biometric device on Dilbert - very appropriate, I thought.

Yes, Rich, you're one of the three, as is Rus (though neither of your comments were angry).  I would estimate that the amount of money spent on testing, planning meetings, and informative emails regarding our "email upgrade" would rival the GPD of a small nation.  And when I say "he" referring to the preventer of information services, I really mean "they," probably on the order of about 50 people.  So the fact that the system broke despite all the money and resources that likely went into testing is what really gets me mad.