You mean you've been making new, unpredictable passwords by tracking only the usernames and counters? You must be good at hashing ;) Seriously though: this is going to be relatively secure only if each counter increase gives you entirely random password.