Who is "they"? Gizmodo is not getting access to the user/password neither do they have access to the user data. Quote from the article: the information was stored on individual users’ computers; we weren’t collecting it centrally

Since the stuff they're probing isn't included in the APIs, they gotta have some account info to provide insight into this behavior.