While it is true that password complexity requirements do reduce the possible search space I'm not sure this is exactly what you're looking for.
Maybe you are referring to the habits of some people to go with more predictable choices (like "Password1") when required to have a mix of lowercase, uppercase, numbers, or symbols. While it is true that implementing password complexity does not prevent use of some weak passwords, it does eliminate the worst of the worst (like "password" and "123456"). But you are right that turning on complexity is not a solution to poor passwords by itself.
If you have evidence that someone is brute forcing passwords over OWA then the logs of the attempts and successes should be enough to show that password complexity is not effective enough. I'm not sure your demonstration of this attack in action would do much more to sway their opinion. And if you are unsuccessful it may actually strengthen their belief that nothing is wrong.
If your goal is to highlight general weaknesses in your fellow employees' password choices then I would suggest password cracking/analysis rather than online brute forcing. It should yield many more weaker passwords in a shorter timeframe which should help highlight any widespread password problems.