Maybe the password is the same for the wp-admin user. Password reuse is a really serious and common problem.