Its possible, if theres a full database dump that direct messages could also be leaked, which could be incredibly damaging. I'd guess that these would be in another storage medium however.

One wonders. Why are encrypted passwords stored in an external code repository?