If he used wget (or similar utility) he could specify password as a command line argument. It's not a very good practice security-wise but people do this sometimes.