An exit node can see traffic between itself and the destination. This is by design; it is unavoidable. The experiment shows that some exit nodes actually are recording that traffic and extracting login credentials from it. There's nothing surprising about it. It's what we've all been suspecting for a long time.

The obvious conclusion is that you should use TLS even when you're connecting via Tor. Tor only gives you anonymity. You still need TLS for confidentiality.