I can confirm that at least as of 2012 or so they were storing passwords as a salted md5 hash. I did point out to a staff member that this was not a good idea and was brushed off, so I assume this hasn't changed since then.