Working in IT I could find many many peoples passwords. Because while the IdP never logged passwords themselves, it did log every username that tried to login. And a lot of people have typed their password in first thinking they had typed their username in already. It's pretty trivial at that point to figure who logged in successfully next and associate the two.