My guess would be this is less about passwords (which - wild guess here - are probably fairly well-secured) and more about ancillary user meta data.