Not exactly. He also had to change the User-agent header.

Also: let's say someone accidentally exposes their password because it's on a post-it in the background of a photo. Clearly this is crappy security; clearly, at that point, information protected by that password is readily available until the password is changed.

The intent of the owner of the data does, in fact, count.