Or they could salt the password hash with the username. Rainbow tables would need to be based on the salt and therefore unlikely to exist.