You are correct. That is also something I tell the clients before they are providing the passwords. That they should make sure that all their passwords are changed. Even so, never reuse your password for Bitcoins as they are too valuable.