Generally they get it from another website, such as fansite forums or places like that. They could also use keyloggers or phishing websites, and they could have other sources as well. It's hard to say all of their resources, but they get the password from other places.