You are correct; any wise attacker would create accounts with known properties before compromising the database for these purposes.