There are two possible ways:
  1. Top down: You have a pubkey, know what system it was created on and then find weak randomness on said system
  2. Bottom up: You know a system with weak randomness. You generete the keypairs for all of the frequent notsorandom numbers. You look on the chain if you find any of these pubkeys being used without any paytopubkeyhash