It sounds more like a badly designed web app than Alexa doing something it shouldn't. If it really did do harvest passwords and log in with them, we'd hear a lot more about it.

As gojomo said it was probably passing the username and password in the URL (query string). I've been burned by the exact same thing before because of Alexa. I had the little Alexa rank FF extension which told Alexa about a page I really wish it hadn't...