Take-away: if you're doing something illicit you'd better reconsider being dumb about passwords. Or would just user names / IPs have done them in?