I wasn't reading the cracked passwords for fun, I was verifying the output. And it was well known that we cracked the passwords, and he had already gotten the first warning that it was cracked, so he knew we knew it.

That's why I didn't feel bad taking it to HR. I already had a sense that he was doing bad stuff, and the password just solidified it for me.