I'd be willing to bet that getting their user's passwords is part of their goal. So they would need to be stored somewhere.