I'd say "not very much" since wrong passwords are almost never stored: unless you failed to obtain login, the password that was right is usually a much juicier bit of information to grab.
It is recommended not to save wrong passwords in logs etc., since they might disclose the real password - even if you entered SqueamishOsprey, a human might guess the real password, and with things like THX138, a computer could do so all by itself by running a Levenshtein classification on a password dictionary.
A wrong password is usually:
- the right password, spelled wrong (majority of the cases in my experience)
- a password that was right but has now expired.
- an old password which is no longer relevant, and never even was
- a current password for another service
is, I believe, even lower in likelihood. Anyone attempting to capture passwords would do so after they'd been validated, or would strive to garner information on their validity on that system, to reduce the burden of dealing with spurious passwords. In so doing, they'd discard yours.
Your risk scenarios are then, I think:
- the wrong password is logged in cleartext, and the attacker succeeds in recovering the cleartext but does not or can not realize that the correct password in that system is another.
- the wrong password is captured (together with the right ones) and sent for exploitation, even if such an exploitation would be much more powerful and/or quick if it weeded out the wrong passwords in the first place (this could happen, for example, if an exploited web site was coupled with a distributed exploitation network. Quickness in the exploitation would trump the need for precision).
- the password interception is done in such a way that the attacker has no way of telling whether it's a good one or a mis-spelled one. He has to try them all. In some way the same interception also supplies enough details on your identity to allow selection of other viable services to gain access to.
- the attack is directed at you (or all users of a small system) - in that case any password will do, and none would be discarded. There's no need for quickness since the victim pool is extremely small.
Personally, I feel that all the above scenario to be quite unlikely. Of course your evaluation might be different - depending on who you are, what's your net worth, where you work, and so on and so forth - all things I won't ask, on the off-chance that you might then have to kill me :-)