Except the human brain has pattern recognition. It's possible that these waves are elicited if your password is simply close to the actual one, maybe the first couple letters or somesuch. Then the algorithm could use that information to narrow down the range it has to check; essentially a game of warm/cold.

This might be completely off, since the article is pretty vague, but it seems like a possibility to me.