Sholdn't the number of conbinations be 36^19, if the password format ist given as !!!!-!!!!-!!!!-!!!!?
Or are the 3 dashes removed from the password before the MD5 Hash.
I have no idea if they are removed or not, but they either never change or removed, which in both cases leaves 16 variable characters.