It sounds like they learned password security from Runescape.