How safe is a brain wallet? Edit: The answer is that they are unsafe and have been attacked. Please don't use them!

Brain wallets can be created with a (minimum 15 character) pass phrase at https://www.bitaddress.org

There are no warnings given on the site about the safety of this. How secure are brain wallets?

A recent contest provided 5 bitcoin (receiving) addresses generated with a brain wallet pass phrase, with each address holding 1BTC as a prize.

The challenger did give some hints along the way, but within 7 hours, the first prize was taken, and after around 18 days, all of them were taken.

The author of the blog summarises that brain wallets are generally safe, but is this really the case?

With a well indexed database of the existing Bitcoin addresses that hold a positive balance and a well-tuned script for trying out likely pass phrases, surely there's some quite long phrases that would still be easy to guess?
They can be made a heck-of-a-lot safer with simple key-stretching.  The WarpWallet runs Scrypt on your passphrase, and outputs a string in the full 256-bit keyspace.  It's at least 1000x more expensive to guess a WarpWallet address than a standard brainwallet address.  And if you had access to high-end scrypt-computing hardware, you're probably better off using it to mine litecoins rather than go after WarpWallets.  See https://keybase.io/warp.  There's a 20BTC challenge to solve an 8-letter WarpWallet passphrase that's been open for almost a month.