Hi intbt,
When a customer first registers for an account their password is sent to their email which helps prevent unauthorized access since they would be the only ones with access to their email account. If they don't have an email address they would not be able to get a password to begin with. If you customize the Contacts screen you can add the PortalUsername and PortalPassword fields and manually assign them a username and password if they need one.
Also I can see an issue with using the account number, let's say the customer's account number is 11111 they can guess and assume that there is an account with 11112 and get the password generated for a different account other than their own.
-Michael