Perhaps the best way to think about this is, if an unauthorized user figured out a username and password and logged in, how bad would it be? If your statement is true:
the only data stored on the user account is his email address.
then this implies that once you are logged in, the entire site is read-only. In other words, authenticating gives you access to certain content that is otherwise not available to the public. If that content became public, would you lose sleep over it? If not, then it probably isn't a big deal from a security standpoint of your site to allow simple passwords, since you have nothing to protect.
That being said, here are some reasons you shouldn't allow easy passwords even if it meets the above criteria:
- Above I specifically emphasized the security "of your site" because your site may be safe, but you also want to protect your users. If an attacker is able to guess a user's easy password, they have possibly learned something about the user. Perhaps the person uses that same password on another website, or as the password for their phone, etc. This information in the hands of an attacker could potentially harm the user. Note you can get around this problem by creating passwords for them instead of letting them choose their own.
- If an attacker doesn't know any email addresses, having simple passwords makes it easier to guess an email/password combination, and thus discovering email addresses. (This is the exact reason why website login errors should not say "The email address was not found", but rather, "The email/password combination was not found". You want to protect against attackers trying to mine emails.)
- What if in the future you decide to add functionality to the website? For example, you may want to allow people to post comments or "like" something. Then you would be storing data specific to a person and you'd have more to protect, and it could be a hassle to change your password system once the site is rolled out and used by many people.
In summary, I agree with crovers. I'd also recommend using strong passwords or a different authentication method.