You can do many evil things with passwords. But, according to the articles, that's not what happened. They did download contact lists, even though they never used the plaintext passwords they stored in the logs. The users involved in the two incidents were different.