They try the username + password on other sites.