If I recall correctly, he said that travel agencies often have their own system (with individual passwords) hooked up to the GDS using a shared login which was set up once long time ago and then forgot.