Also possible that the user read & understood the message but didn't take it as proof of its claim.

FB has a history of collecting cross-site passwords from failed logins.