I think for me, it's a kind of coping thing where I secretly hope that the next software will be the one thing I was missing the entire time and from here on out learning will be a breeze. Of course, that's not going to happen ... or will it? I am sure the next thing I find will be it!
> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt
Sorry, but this is no excuse. It has been 15 years and there were so many breaches that even many casual people know about databases leaks and that passwords have to be stored in some special way. I don't know this guy's background, but he at least knows that md5 is not sufficient here. And then it never crossed his mind to do a check up on this? That's just negligent.