They aren't magicians. They can't pull passwords out of thin air. They have to get it from somewhere.