Um... if "they" are system administrators, they do not need to brute-force password. They can just change it to whatever they want.