All of the events you mention were in October after the emails were released by Wikileaks.
The spearphishing attack happened in March.
https://wikileaks.org/podesta-emails/emailid/34899#efmAAGAAb...
Also his password was never p@ssword, that was his Windows machine default pass.