And why weren't the passwords hashed/salted?