That evidence isn't conclusive. They could be entering the password into an application that verifies with a hashed value.