The attacker controls the login form. They could use javascript to just scrape it out of the password field if they wanted to. Those solutions might get in the way of existing tools for logging password forms, but there are trivial workarounds.