I assume everything I enter into a form is recorded, even if I don't hit submit. I'm surprised they were listening to onBlur instead of onKeyPress. Partial information could be exploitable too.
I was acquainted with some black hats in junior high and high school. Guessing how they are as adults, I'm pretty sure you can always find someone who will do it for the lulz, if not for the money.