How did they make it work? Even given the passwords, how would they check robustly without tripping the email "unusual connection from IP x.x.x.x". Even if they have a few IP to make the checks, the mail server may notice that one IP is connecting to thousands of accounts.