Probably logging the HTTP/S requests, which included usernames & passwords in plaintext.