What was their password hashing algorithm? The lack of specificity isn't encouraging. The vague "hashed and salted" could mean anything from MD5 upwards.