I don't understand how it's possible to create a list of the worst passwords used if they're (allegedly) encrypted? Are they collected anonymously before saving in the database especially for this purpose? Or it's just a poll?
When LinkedIn was hacked in 2012, nearly 6.5 million password hashes were leaked. Because LinkedIn failed to salt their passwords, it was easy to compute hashes of common English words and combinations, and analyze which were used the most.
I'm not saying this is the only way, but it's one of the possible ways to figure out the "worst used passwords", as you say.