Don't really matter. It's like saying if I left my front door unlocked it's ok to rob me.

Just because the password is known or guessed, it does not give the right to access the account and it's information.

Besides, the ISP's user policy would be in effect.