imo, their are comparing the hash of the 3 versions against a stored hash. This will help slowing down brute force attacks(
http://en.wikipedia.org/wiki/Bcrypt), although it does make brute force attack 3 times easier, since now you can hit the correct password 3 times with the same set of characters.