You’re right since digital content cannot be stolen, but it is well documented that some of the accounts are “used” via phishing, brute forcing and zero day exploits on the university/library’s platform, which is perhaps what GP meant.