And after donating credentials, the donor and IT are better off just claiming the password was "phished" (winkwink) when caught.