Basically, sensitive information was simply MD5 hashed. Since the input was limited (3 numbers, 3 letters, at most), it was easy to make some brute-force attack: generate all possible combinations and then do a look-back.
Considering the nature of the information (very small input, to easy to generate all combinations), how could this data be properly anonymized?
Some approaches that have occurred to me::
Security through obscurity (use a "secret" number of iterations) is just security through obscurity.
Append a general, unique salt, would increase the brute-force by 0%: simple append the salt and done.
Appending a unique salt per user, would increase the brute-force, but not too much: take the salt and calculate the 3 digit 3 letters for each salt.
What could be done?