He might have been referring to user specific salts? It would certainly be a lot more challenging for them to test every common password with every user's salt.