I realize this isn't exactly the point, but couldn't he just tell them he 'forgot' his password? It's not like they'd be able to prove otherwise.