Interesting find. Could also check for session reuse in case they captured cookies from the original logins.