Special character requirements normally end with most people adding # to the end of their dictionary vulnerable password, plus a lot more of valid password reset requests that could hide phishing attacks.
Seems like the reason for this is that a lot of places don't accept them as special characters. The exclamation mark (!) and hash (#) are almost guaranteed to be on the special character list, so people likely choose them out of habit.
