I am not commenting on the reason why your code behaves as it does as that seems to be discovered already, but rather on the code itself, or more particularly, on what appears to be a very strange password policy.

I ran the following code against this subroutine:

foreach ('test_NO PASSWORD', 'test_PASSWORD', 'test_test', 'test', 'te
+st_abc???????def') {
    print "$_: ", getPasswordStatus(split /_/), "\n";
}
[download]

and got the following result:

test_NO PASSWORD:     empty
test_PASSWORD:        password
test_test:            login
test:                 ok
test_abc???????def:   ok
test_A gOoD PASsword: weak
[download]

<p So if I understand this password-policy it is:

1. an empty password is OK
2. a password with 7 consecutive question marks is OK
3. all other passwords are weak or are unacceptable for other reasons.

Of all the hare-brained password policies I have ever seen, this must rank within the top 3!