Because pass the hash only works for the current server. People reuse passwords, so without brute-forcing you are out of luck.