Maybe they keylog and incrementally hash everything including password subset? Seems implausible.